Old version and no CVE listed: does that make it safe?

No. A missing CVE only means no one has published a matching entry. An old version may be past its support period, may have flaws nobody reported, or may belong to a project that never requests CVEs. Check whether it still gets fixes before you call it safe.

Why the lists can be silent

CVE entries exist when someone found a problem, reported it and a record was published. Small projects often fix bugs without ever assigning an identifier. Old, unmaintained software may have had no review at all. Silence can mean quiet, or it can mean nobody looked.

The support question

For a version of a product, ask whether the project still supports it. Many projects maintain only the latest release line, or the latest two. A version outside that window gets no fix, so any future flaw stays open on it. That makes it risky even if the list is clean today.

What else to look at

• The release date and the date of the last release in that line.
• Whether newer versions list security fixes that mention yours as affected.
• Whether its dependencies are also old and flagged.
• Whether the project announces an end of life date.

Reading newer advisories backwards

A useful trick: read the changelog of the newest version. If recent releases fix security bugs, ask whether those bugs could exist in your old version. Often they do, and the advisory just does not list the old line because it is out of support.

What to do

If the version is unsupported, plan to move. If it is supported but old, update to the latest patch in your line. If you cannot move, put controls around it: limit network exposure, restrict who can reach it and watch it more closely.

A note on scanners

A scanner can only flag what the data says. Treat a clean result on end of life software as incomplete, not reassuring.

Quick check

Last reviewed: 19 October 2026.