Patch BIND 9.x TKEY DoS Flaw by Oct 11 to Avoid Server Crashes and Meet CISA Mandate

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-5477 to its Known Exploited Vulnerabilities (KEV) catalog, setting a strict federal due date of October 11, 2026, for mitigation. Small-business owners and IT administrators must ensure their ISC BIND DNS servers are patched or mitigated before this deadline to avoid non-compliance and potential service disruption.

This vulnerability, rated High severity with a CVSS score of 7.5, stems from data processing errors within the BIND software. According to the National Vulnerability Database (NVD), the flaw allows remote attackers to cause a denial-of-service condition. Specifically, malicious TKEY queries can trigger a REQUIRE assertion failure, causing the BIND daemon to exit unexpectedly. This results in a complete loss of DNS resolution services for the affected organization.

Technical Context and Attack Vector

The core issue lies in how older versions of ISC BIND handle TKEY (DNS Security System for Key Agreement) queries. TKEY is a mechanism used to establish shared secrets between DNS servers and clients, often used in secure DNS environments. However, the implementation in vulnerable versions fails to properly process certain malformed or malicious TKEY requests.

When an attacker sends a crafted TKEY query to a vulnerable server, the software encounters a processing error. This error triggers an internal assertion failure—a safety check that confirms the software’s state is valid. When this check fails, the BIND daemon terminates itself to prevent further instability. Because DNS is a foundational service for internet connectivity, this termination effectively knocks the server offline, making it unavailable for legitimate users.

The weaknesses associated with this vulnerability are categorized under CWE-19 (Information Exposure Through a Directory Listing) and CWE-617 (Synchronization Error When Accessing a Shared Resource), according to NVD records. These classifications highlight the underlying issues in data handling and resource synchronization that attackers exploit.

Affected Systems and Compliance Requirements

The vulnerability impacts ISC BIND versions 9.x prior to 9.9.7-P2 and versions 9.10.x prior to 9.10.2-P3. Organizations running these specific versions are at immediate risk if their DNS servers are exposed to the internet or if they process queries from untrusted sources.

CISA’s inclusion of CVE-2025-5477 in the KEV catalog means that federal agencies and their contractors must prioritize this patch. The required action, as stated in the CISA entry, is to apply mitigations in accordance with vendor instructions. This includes ensuring compliance with CISA’s Binding Operational Directive (BOD) 26-04, which mandates prioritizing security updates based on risk.

For cloud services or environments where vendor-provided mitigations are unavailable, CISA advises discontinuing the use of the affected product. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring strict adherence to the patching guidelines outlined in BOD 26-04. The federal due date of October 11, 2026, is the final deadline for compliance.

What to watch

Administrators should immediately audit their DNS infrastructure to identify any instances of ISC BIND running versions 9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3. If vulnerable versions are detected, upgrade to the latest stable release or apply vendor-provided mitigations. For organizations where patching is not immediately feasible, consider restricting TKEY query access to trusted sources only. Monitor CISA and ISC for any updates regarding ransomware usage of this vulnerability, which is currently listed as unknown.

What to do and how to stay safe: ISC BIND

• Advisories bridge the gap between raw vulnerability data and business risk, enabling informed patch prioritization.
• Ignoring advisories leads to technical debt accumulation, where minor issues compound into complex, unpatchable system failures.
• Structured advisory workflows reduce mean time to remediate by eliminating guesswork and focusing efforts on high-impact threats.

Security advisories provide the technical context necessary to prioritize patches and mitigate risks effectively. Review advisories daily and map them to your specific assets to focus remediation efforts where they matter most.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What exactly is CVE-2025-5477?

It is a high-severity data processing error in ISC BIND that allows remote attackers to cause a denial of service via TKEY queries.

Which versions of BIND are affected?

ISC BIND 9.x versions before 9.9.7-P2 and 9.10.x versions before 9.10.2-P3 are vulnerable.

What is the CISA deadline for fixing this?

The federal due date for mitigation is October 11, 2026.