--- title: "BIND 9 Software Vulnerability Matrix" slug: "aa-00913" description: "The BIND 9 Security Vulnerability Matrix is a tool to help DNS operators understand the current security risk for a given version of BIND." tags: ["bind 9", "security", "vulnerability", "BIND 9-S", "Security Vulnerability Matrix"] updated: 2026-10-21T12:46:39Z published: 2026-10-21T12:46:39Z canonical: "kb.isc.org/aa-00913" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.isc.org/llms.txt > Use this file to discover all available pages before exploring further. # BIND 9 Software Vulnerability Matrix The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in supported versions of BIND. Vulnerabilities are identified by their CVE ID: [Common Vulnerabilities and Exposures](https://www.cve.org/). This page was previously called the "BIND 9 Security Vulnerability Matrix". ## Using this matrix Each row with a CVE ID gives the version(s) that fix that problem. ### Determining vulnerability To determine if/how a **given version** is vulnerable: - Find the column heading for the corresponding branch (9.X version) - Read down that column to find the specific 9.X.Y version (or use "Find" in your browser) To determine if a **given CVE** applies: - Read down the "CVE ID" column to find the CVE ID (or use "Find" in your browser) - If you do not know the CVE ID, consult the [complete list of all BIND advisories](/docs/all-bind-advisories) Once you find a given table row (CVE ID and/or version): - The listed version(s) contain fixes for that CVE, and are ***not*** vulnerable to that CVE - A dash (-) indicates no version of that branch (column) is vulnerable to that CVE (row) - That version ***is*** vulnerable to ***later*** CVEs (above the row) - That version is ***not*** vulnerable to ***earlier*** CVEs (below the row) For table rows without a CVE: - A dash (-) indicates that row does not apply to that branch (column) ### Supported Preview Edition - Most CVEs apply equally to both the open source edition and the Supported Preview Edition (-S). - If a row lists the `-S1` suffix, the CVE applies ***only*** to the Supported Preview Edition. - If no `-S1` suffix is present, the CVE applies to both editions. ### Other BIND versions The major branches on this page will always reflect the currently-supported stable branch(es) of BIND. See [ISC's Software Support Policy and Version Numbering](/docs/aa-00896). Older branches of BIND are no longer supported, generally do not receive fixes, and may not even be assessed for vulnerability. For historical reference, please see [matrices for obsolete branches](/docs/obsolete-bind-vulnerability-lists). Development, alpha, beta, or release candidate (RC) versions are not listed here. We recommend that you use only stable branches in any environment for which security is a concern. ## The matrix Each row with a CVE ID gives the version(s) that fix that problem. | Date | CVE ID | 9.20 | | --- | --- | --- | | 2026-10-21 | [CVE-2026-19630](/docs/cve-2026-19630) | 9.20.30 | | 2026-10-21 | [CVE-2026-94300](/docs/cve-2026-94300) | 9.20.30 | | 2026-10-21 | [CVE-2026-96888](/docs/cve-2026-96888) | 9.20.30 | | 2026-10-21 | [CVE-2026-97313](/docs/cve-2026-97313) | 9.20.30 | | 2026-09-16 | [CVE-2026-81736](/docs/cve-2026-81736) | 9.20.29 | | 2026-09-16 | [CVE-2026-19667](/docs/cve-2026-19667) | 9.20.29 | | 2026-09-16 | [CVE-2026-19662](/docs/cve-2026-19662) | 9.20.29 | | 2026-09-16 | [CVE-2026-19941](/docs/cve-2026-19941) | 9.20.29 | | 2026-09-16 | [CVE-2026-77692](/docs/cve-2026-77692) | 9.20.29 | | 2026-09-16 | [CVE-2026-78301](/docs/cve-2026-78301) | 9.20.29 | | 2026-09-16 | [CVE-2026-81563](/docs/cve-2026-81563) | 9.20.29 | | 2026-09-16 | [CVE-2026-19666](/docs/cve-2026-19666) | 9.20.29 | | 2026-09-16 | [CVE-2026-76163](/docs/cve-2026-76163) | 9.20.29 | | 2026-09-16 | [CVE-2026-80274](/docs/cve-2026-80274) | 9.20.29 | | 2026-09-16 | [CVE-2026-19033](/docs/cve-2026-19033) | 9.20.29 | | 2026-09-16 | [CVE-2026-19668](/docs/cve-2026-19668) | 9.20.29 | | 2026-09-16 | [CVE-2026-75029](/docs/cve-2026-75029) | 9.20.29 | | 2026-09-16 | [CVE-2026-77119](/docs/cve-2026-77119) | 9.20.29 | | 2026-09-08 | Release Withdrawn | 9.20.28 | | 2026-08-19 | No CVEs fixed in this release | 9.20.27 | | 2026-07-22 | [CVE-2026-10723](/docs/cve-2026-10723) | 9.20.26 | | 2026-07-22 | [CVE-2026-10822](/docs/cve-2026-10822) | 9.20.26 | | 2026-07-22 | [CVE-2026-11331](/docs/cve-2026-11331) | 9.20.26 | | 2026-07-22 | [CVE-2026-11605](/docs/cve-2026-11605) | 9.20.26 | | 2026-07-22 | [CVE-2026-11622](/docs/cve-2026-11622) | 9.20.26 | | 2026-07-22 | [CVE-2026-11721](/docs/cve-2026-11721) | 9.20.26 | | 2026-07-22 | [CVE-2026-12617](/docs/cve-2026-12617) | 9.20.26 | | 2026-07-22 | [CVE-2026-13204](/docs/cve-2026-13204) | 9.20.26 | | 2026-07-22 | [CVE-2026-13321](/docs/cve-2026-13321) | 9.20.26 | | 2026-07-20 | Release Withdrawn | 9.20.25 | | 2026-06-17 | No CVEs fixed in this release | 9.20.24 | | 2026-05-20 | [CVE-2026-3039](/docs/cve-2026-3039) | 9.20.23 | | 2026-05-20 | [CVE-2026-3592](/docs/cve-2026-3592) | 9.20.23 | | 2026-05-20 | [CVE-2026-3593](/docs/cve-2026-3593) | 9.20.23 | | 2026-05-20 | [CVE-2026-5946](/docs/cve-2026-5946) | 9.20.23 | | 2026-05-20 | [CVE-2026-5947](/docs/cve-2026-5947) | 9.20.23 | | 2026-05-20 | [CVE-2026-5950](/docs/cve-2026-5950) | 9.20.23 | | 2026-04-01 | No CVEs fixed in this release | 9.20.22 | | 2026-03-25 | [CVE-2026-1519](/docs/cve-2026-1519) | 9.20.21 | | 2026-03-25 | [CVE-2026-3104](/docs/cve-2026-3104) | 9.20.21 | | 2026-03-25 | [CVE-2026-3119](/docs/cve-2026-3119) | 9.20.21 | | 2026-03-25 | [CVE-2026-3591](/docs/cve-2026-3591) | 9.20.21 | | 2026-02-27 | No CVEs fixed in this release | 9.20.20 | | 2026-02-18 | No CVEs fixed in this release | 9.20.19 | | 2026-01-21 | [CVE-2025-13878](/docs/cve-2025-13878) | 9.20.18 | | 2025-12-17 | No CVEs fixed in this release | 9.20.17 | | 2025-11-19 | No CVEs fixed in this release | 9.20.16 | | 2025-10-22 | [CVE-2025-8677](/docs/cve-2025-8677) | 9.20.15 | | 2025-10-22 | [CVE-2025-40778](/docs/cve-2025-40778) | 9.20.15 | | 2025-10-22 | [CVE-2025-40780](/docs/cve-2025-40780) | 9.20.15 | | 2025-10-08 | Release Withdrawn | 9.20.14 | | 2025-09-10 | No CVEs fixed in this release | 9.20.13 | | 2025-08-20 | No CVEs fixed in this release | 9.20.12 | | 2025-07-16 | [CVE-2025-40776](/docs/cve-2025-40776) | 9.20.11-S1 | | 2025-07-16 | [CVE-2025-40777](/docs/cve-2025-40777) | 9.20.11 | | 2025-06-18 | No CVEs fixed in this release | 9.20.10 | | 2025-05-21 | [CVE-2025-40775](/docs/cve-2025-40775) | 9.20.9 | | 2025-04-16 | No CVEs fixed in this release | 9.20.8 | | 2025-03-19 | No CVEs fixed in this release | 9.20.7 | | 2025-02-19 | No CVEs fixed in this release | 9.20.6 | | 2025-01-29 | [CVE-2024-11187](/docs/cve-2024-11187) | 9.20.5 | | 2025-01-29 | [CVE-2024-12705](/docs/cve-2024-12705) | 9.20.5 | | 2024-12-11 | No CVEs fixed in this release | 9.20.4 | | 2024-10-16 | No CVEs fixed in this release | 9.20.3 | | 2024-09-18 | No CVEs fixed in this release | 9.20.2 | | 2024-08-21 | No CVEs fixed in this release | 9.20.1 | | 2024-07-23 | No CVEs fixed in this release | 9.20.0 | ## Related - [ISC CVSS Scoring Guidelines](/isc-cvss-scoring-guidelines.md) - [ISC Software Defect and Vulnerability Disclosure Policy](/aa-00861.md) - [ISC's Software Support Policy and Version Numbering](/aa-00896.md)