# ISC BIND software security vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/isc-bind-software-security-vulnerabilities
> Updated: 2026-10-09T00:36:28.000Z. Sources: 4. Developments: 2.

Security vulnerabilities have been identified in the ISC BIND DNS software. Initial reports from the Internet Systems Consortium (ISC) highlighted several CVEs involving memory safety issues, such as use-after-free errors and null pointer dereferences, as well as resource exhaustion and trust-boundary failures. In Japan, the Information-technology Promotion Agency (IPA) and JPCERT/CC issued advisories regarding these risks.

Subsequent reports from INCIBE identified a specific vulnerability (CVE-2015-5477) in ISC BIND that allows remote attackers to cause a denial of service through TKEY queries in certain versions.

## Timeline

### 2026-10-09: INCIBE reports vulnerabilities in ISC BIND, Aruba, and ZyXEL products

INCIBE reports high and critical vulnerabilities in ISC BIND, Aruba Networks, and ZyXEL NAS devices, including risks of remote code execution and denial of service.

2 sources. https://clstr.news/cluster/incibe-reports-vulnerabilities-in-isc-bind-aruba-and-zyxel-products

### 2026-09-22: ISC BIND software faces multiple security vulnerabilities

Multiple vulnerabilities, including memory safety and resource exhaustion flaws, have been identified in ISC BIND DNS software, prompting security advisories from ISC and JPCERT/CC.

2 sources. https://clstr.news/cluster/isc-bind-software-faces-multiple-security-vulnerabilities

---
Cite as: ISC BIND software security vulnerabilities. CLSTR, https://clstr.news/situations/isc-bind-software-security-vulnerabilities