Check your version
named -vAffected version lines
- 9.21 10 CVEs
- 9.20 19 CVEs
- 9.19 11 CVEs
- 9.18 36 CVEs End of life
- 9.17 21 CVEs
- 9.16 41 CVEs End of life
- 9.15 29 CVEs
- 9.14 31 CVEs
- 9.13 31 CVEs
- 9.12 36 CVEs
- 9.11 55 CVEs
- 9.10 60 CVEs KEV 1
- 9.9 69 CVEs KEV 1
- 9.8 54 CVEs KEV 1
- 9.7 56 CVEs KEV 1
- 9.6 54 CVEs KEV 1
- 9.5 53 CVEs KEV 1
- 9.4 57 CVEs KEV 1
- 9.3 52 CVEs KEV 1
- 9.2 50 CVEs KEV 1
- 9.1 47 CVEs KEV 1
- 9.0 45 CVEs
- 8.4 13 CVEs
- 8.3 16 CVEs
- 8.2 25 CVEs
- 8.1 16 CVEs
- 8.0 14 CVEs
- 4.9 25 CVEs
- 4.0 12 CVEs
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2015-5477 | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of... | ≥ 9.1.0 < 9.9.7 ≥ 9.10.0 < 9.10.2 = 9.10.2 | 7.5 | KEV | 99.6% | 2015-07-29 |
| CVE-2026-13204 | Unexpected exit in certain situations with NSEC and NSEC3 both present | ≥ 9.11.3 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 7.5 | — | 2026-07-22 | |
| CVE-2026-13321 | DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field | ≥ 9.11.3 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 8.6 | — | 2026-07-22 | |
| CVE-2026-10723 | Incorrect acceptance of NSEC3 records | ≥ 9.11.3 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 6.8 | — | 2026-07-22 | |
| CVE-2026-10822 | Key Record using PRIVATEDNS algorithm may lead to unexpected exit | ≥ 9.18.11 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 6.5 | — | 2026-07-22 | |
| CVE-2026-11331 | Potential wildcard CNAME RPZ policy bypass | ≥ 9.16.8 ≤ 9.18.50 ≥ 9.18.0 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 7.5 | — | 2026-07-22 | |
| CVE-2026-11605 | Unnecessary validation of DNSSEC signed records | ≥ 9.20.9 ≤ 9.20.24 | 7.5 | — | 2026-07-22 | |
| CVE-2026-11622 | Potential memory usage beyond configured limits | ≥ 9.11.3 ≤ 9.18.50 ≥ 9.18.0 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 7.5 | — | 2026-07-22 | |
| CVE-2026-11721 | Cache poisoning possible with label count discrepancy, RRSIG, and wildcards | ≥ 9.11.3 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 7.5 | — | 2026-07-22 | |
| CVE-2026-12617 | Record ordering based unexpected exit with CNAME or DNAME | ≥ 9.18.11 ≤ 9.18.50 ≥ 9.20.9 ≤ 9.20.24 | 7.5 | — | 2026-07-22 | |
| CVE-2026-5946 | Invalid handling of CLASS != IN | ≥ 9.18.0 < 9.18.49 ≥ 9.20.0 < 9.20.23 ≥ 9.21.0 < 9.21.22 | 7.5 | — | 2026-05-20 | |
| CVE-2026-5947 | SIG(0) validation during query flood may lead to undefined behavior | ≥ 9.20.0 < 9.20.23 ≥ 9.21.0 < 9.21.22 | 5.9 | — | 2026-05-20 | |
| CVE-2026-5950 | Unbounded resend loop in BIND 9 resolver | ≥ 9.18.36 < 9.18.49 ≥ 9.20.8 < 9.20.23 ≥ 9.21.7 < 9.21.21 | 5.3 | — | 2026-05-20 | |
| CVE-2026-3039 | BIND 9 server memory exhaustion during GSS-API TKEY negotiation | ≥ 9.18.0 < 9.18.49 ≥ 9.20.0 < 9.20.23 ≥ 9.21.0 < 9.21.22 | 7.5 | — | 2026-05-20 | |
| CVE-2026-3592 | Amplification vulnerabilities via self-pointed glue records | ≥ 9.18.0 < 9.18.49 ≥ 9.20.0 < 9.20.23 ≥ 9.21.0 < 9.21.22 | 5.3 | — | 2026-05-20 | |
| CVE-2026-3593 | Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation | ≥ 9.20.0 < 9.20.23 ≥ 9.21.0 < 9.21.22 | 9.8 | — | 2026-05-20 | |
| CVE-2026-3119 | Authenticated query containing a TKEY record may cause named to terminate unexpectedly | ≥ 9.20.0 < 9.20.21 ≥ 9.21.0 < 9.21.20 | 6.5 | — | 2026-03-25 | |
| CVE-2026-3591 | A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass | ≥ 9.20.0 < 9.20.21 ≥ 9.21.0 < 9.21.20 | 5.4 | — | 2026-03-25 | |
| CVE-2026-3104 | Memory leak in code preparing DNSSEC proofs of non-existence | ≥ 9.20.0 < 9.20.21 ≥ 9.21.0 < 9.21.20 | 7.5 | — | 2026-03-25 | |
| CVE-2026-1519 | Excessive NSEC3 iterations cause high CPU load during insecure delegation validation | ≥ 9.18.0 < 9.18.47 ≥ 9.20.0 < 9.20.21 ≥ 9.21.0 < 9.21.20 | 7.5 | — | 2026-03-25 | |
| CVE-2023-50387 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote atta... | ≥ 9.0.0 ≤ 9.16.46 ≥ 9.18.0 ≤ 9.18.22 ≥ 9.19.0 ≤ 9.19.20 | 7.5 | — | 2024-02-14 | |
| CVE-2023-50868 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows r... | ≥ 9.0.0 < 9.16.48 ≥ 9.9.3 < 9.16.48 ≥ 9.18.0 < 9.18.24 | 7.5 | — | 2024-02-14 | |
| CVE-2023-6516 | Specific recursive query patterns may lead to an out-of-memory condition | = 9.16.8 = 9.16.11 = 9.16.12 | 7.5 | — | 2024-02-13 | |
| CVE-2023-4408 | Parsing large DNS messages may cause excessive CPU load | = 9.9.3 = 9.16.8 = 9.16.11 | 7.5 | — | 2024-02-13 | |
| CVE-2023-5517 | Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled | = 9.16.8 = 9.16.11 = 9.16.12 | 7.5 | — | 2024-02-13 | |
| CVE-2023-5679 | Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution | = 9.16.12 = 9.16.13 = 9.16.14 | 7.5 | — | 2024-02-13 | |
| CVE-2023-5680 | Cleaning an ECS-enabled cache may cause excessive CPU load | = 9.11.3 = 9.11.4 = 9.11.5 | 5.3 | — | 2024-02-13 | |
| CVE-2023-4236 | named may terminate unexpectedly under high DNS-over-TLS query load | ≥ 9.18.0 < 9.18.18 = 9.18.11 = 9.18.18 | 7.5 | — | 2023-09-20 | |
| CVE-2023-3341 | A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly | ≥ 9.2.0 < 9.16.44 ≥ 9.18.0 < 9.18.19 ≥ 9.19.0 < 9.19.17 | 7.5 | — | 2023-09-20 | |
| CVE-2023-2828 | named's configured cache size limit can be significantly exceeded | ≥ 9.11.3 ≤ 9.16.41 ≥ 9.18.11 ≤ 9.18.15 | 7.5 | — | 2023-06-21 | |
| CVE-2023-2829 | Malformed NSEC records can cause named to terminate unexpectedly when synth-from-dnssec is enabled | ≥ 9.16.8 ≤ 9.16.41 ≥ 9.18.11 ≤ 9.18.15 | 7.5 | — | 2023-06-21 | |
| CVE-2023-2911 | Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeo... | ≥ 9.18.11 ≤ 9.18.15 | 7.5 | — | 2023-06-21 | |
| CVE-2022-3924 | named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota | ≥ 9.16.12 < 9.16.37 ≥ 9.18.0 < 9.18.11 ≥ 9.19.0 < 9.19.9 | 7.5 | — | 2023-01-26 | |
| CVE-2022-3736 | named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries | ≥ 9.16.12 < 9.16.37 ≥ 9.18.0 < 9.18.11 ≥ 9.19.0 < 9.19.9 | 7.5 | — | 2023-01-26 | |
| CVE-2022-3488 | named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries | = 9.11.4 = 9.11.37 = 9.16.8 | 7.5 | — | 2023-01-26 | |
| CVE-2022-3094 | An UPDATE message flood may cause named to exhaust all available memory | ≥ 9.16.0 < 9.16.37 ≥ 9.18.0 < 9.18.11 ≥ 9.19.0 < 9.19.9 | 7.5 | — | 2023-01-26 | |
| CVE-2022-2795 | Processing large delegations may severely degrade resolver performance | ≥ 9.0.0 < 9.16.33 ≥ 9.18.0 < 9.18.7 ≥ 9.19.0 < 9.19.5 | 5.3 | — | 2022-09-21 | |
| CVE-2022-2881 | Buffer overread in statistics channel code | ≥ 9.18.0 < 9.18.7 ≥ 9.19.0 < 9.19.5 | 8.2 | — | 2022-09-21 | |
| CVE-2022-2906 | Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only) | ≥ 9.18.0 < 9.18.7 ≥ 9.19.0 < 9.19.5 | 7.5 | — | 2022-09-21 | |
| CVE-2022-38177 | Memory leak in ECDSA DNSSEC verification code | ≥ 9.8.4 ≤ 9.16.32 = 9.9.3 = 9.9.12 | 7.5 | — | 2022-09-21 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).