CVE-2026-116013

OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

Published Oct 24, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.

Analysis

Technical impact

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability that fails to verify resource record lengths in the DNS response. This allows an attacker that can control or spoof the queried nameserver to send truncated record headers or RDATA, causing unhandled Lua exceptions in resolver:query(). The exception aborts the request and breaks name resolution, leading to denial of service for applications relying on this resolver.

Affected Systems

Affects installations of the openresty:lua-resty-dns library prior to version 0.24. Any deployment of OpenResty or other frameworks that use this DNS resolver and perform DNS queries is vulnerable. The flaw exists in versions 0.23 and earlier.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known exploitation in the wild. The likely attack vector is remote: an adversary sends a crafted DNS response to a resolver request over the network. An attacker must control or spoof the IP of the nameserver used by the application. Because the error is unhandled, each overrun terminates the request, which can accumulate to a denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

openresty

lua-resty-dns

unaffected

Version	Status	Constraints
`0`	affected	< 0.24

No data.

Vendor Product Versions

Openresty

Lua-resty-dns

Version	Status	Scheme	Platform
`[0,0.24)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade lua-resty-dns to version 0.24 or later, which adds proper length checks in parse_section() and _decode_name().
If an upgrade is not immediately feasible, restrict DNS queries to known, reliable nameservers and configure firewalls or security groups to block spoofed responses from any other source, reducing the window for malicious response delivery.
Monitor DNS traffic and application logs for abnormal exceptions or repeated failures; if these alerts increase, prioritize applying the library update or implementing stricter DNS validation.

Generated by OpenCVE AI on October 24, 2026 at 12:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.288% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/openresty/lua-resty-dns/blob/v0.23/lib/resty/dns/resolver.lua#L396-L442
https://github.com/openresty/lua-resty-dns/commit/b68eaecbf7997ac71c08ba56032b1f45438bd758
https://github.com/openresty/lua-resty-dns/pull/83
https://github.com/openresty/lua-resty-dns/tree/v0.24
https://www.vulncheck.com/advisories/openresty-lua-resty-dns-before-0.24-denial-of-service-via-dns-response-parsing

History

Oct 29, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openresty Openresty lua-resty-dns
Vendors & Products		Openresty Openresty lua-resty-dns

Oct 24, 2026 11:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
Title		OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
Weaknesses		CWE-130
References		https://github.com/openresty/lua-resty-dns/blob/v0.23/lib/resty/dns/resolver.lua#L396-L442 https://github.com/openresty/lua-resty-dns/commit/b68eaecbf7997ac71c08ba56032b1f45438bd758 https://github.com/openresty/lua-resty-dns/pull/83 https://github.com/openresty/lua-resty-dns/tree/v0.24 https://www.vulncheck.com/advisories/openresty-lua-resty-dns-before-0.24-denial-of-service-via-dns-response-parsing
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`