Live › vulnerability › CVE-2026-116013
Go to dashboardThe lua-resty-dns library for OpenResty fails to check DNS record lengths, so a malformed reply from a queried nameserver raises an uncaught Lua exception. An attacker who controls or spoofs that nameserver can abort requests and break name resolution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Services built on OpenResty that use lua-resty-dns to resolve names at request time are exposed. The risk depends on the resolver path: a spoofed or hostile nameserver is needed, so systems using trusted, internal resolvers face less exposure. Teams that do not run OpenResty or lua-resty-dns can skip it.
No product ranges from the sources yet.
opm list or the lua-resty-dns source file's version headerresolver:query() on untrusted or unreliable nameservers0.24 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
This page as .md · .json · in your agent: get_signal("CVE-2026-116013")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.