Description
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
Published: 2026-10-24
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service (name resolution)
Action: Patch
AI Analysis

Impact

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability that fails to verify resource record lengths in the DNS response. This allows an attacker that can control or spoof the queried nameserver to send truncated record headers or RDATA, causing unhandled Lua exceptions in resolver:query(). The exception aborts the request and breaks name resolution, leading to denial of service for applications relying on this resolver.

Affected Systems

Affects installations of the openresty:lua-resty-dns library prior to version 0.24. Any deployment of OpenResty or other frameworks that use this DNS resolver and perform DNS queries is vulnerable. The flaw exists in versions 0.23 and earlier.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known exploitation in the wild. The likely attack vector is remote: an adversary sends a crafted DNS response to a resolver request over the network. An attacker must control or spoof the IP of the nameserver used by the application. Because the error is unhandled, each overrun terminates the request, which can accumulate to a denial of service.

Generated by OpenCVE AI on October 24, 2026 at 12:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade lua-resty-dns to version 0.24 or later, which adds proper length checks in parse_section() and _decode_name().
  • If an upgrade is not immediately feasible, restrict DNS queries to known, reliable nameservers and configure firewalls or security groups to block spoofed responses from any other source, reducing the window for malicious response delivery.
  • Monitor DNS traffic and application logs for abnormal exceptions or repeated failures; if these alerts increase, prioritize applying the library update or implementing stricter DNS validation.

Generated by OpenCVE AI on October 24, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
Title OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
Weaknesses CWE-130
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-24T11:40:31.527Z

Reserved: 2026-10-24T11:23:54.934Z

Link: CVE-2026-116013

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-24T12:16:57.437

Modified: 2026-10-24T12:16:57.437

Link: CVE-2026-116013

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T12:30:08Z

Weaknesses
  • CWE-130

    Improper Handling of Length Parameter Inconsistency