CVE-2026-116013: Improper Handling of Length Parameter Inconsistency in openresty lua-resty-dns
Affects openresty lua-resty-dnsSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| openrestylua-resty-dns | Affected
| Fixed in
|
GitHub Actionslua-resty-dnspkg:github/lua-resty-dnsOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in lua-resty-dns version 0.24 and later. Users should upgrade to version 0.24 or newer to remediate this vulnerability. No other mitigation guidance is provided.
Description
CVE-2026-116013 is a vulnerability in OpenResty lua-resty-dns versions before 0.24 where improper input validation in parse_section() and _decode_name() allows attackers controlling or spoofing a DNS server to send malformed DNS responses. This causes uncaught Lua exceptions in resolver:query(), aborting DNS requests and breaking name resolution.
Summary
OpenResty lua-resty-dns prior to version 0.24 contains an input validation flaw in the functions parse_section() and _decode_name(). These functions fail to verify that resource record lengths match the actual received message length. An attacker who controls or spoofs a DNS server can exploit this by sending truncated record headers or RDATA, triggering uncaught Lua exceptions during DNS resolution. This results in aborted DNS queries and disrupted name resolution processes.
Impact
The vulnerability causes DNS resolution failures by aborting resolver queries due to uncaught exceptions. This can lead to denial of service for applications relying on lua-resty-dns for DNS lookups. There is no indication of remote code execution or data leakage from the provided data.
References
- github.com/openresty/lua-resty-dns/pull/83 (opens in a new tab)
- github.com/openresty/lua-resty-dns/commit/b68eaecbf7997ac71c08ba56032b1f45438bd758 (opens in a new tab)
- github.com/openresty/lua-resty-dns/blob/v0.23/lib/resty/dns/resolver.lua (opens in a new tab)
- github.com/openresty/lua-resty-dns/tree/v0.24 (opens in a new tab)
- vulncheck.com/advisories/openresty-lua-resty-dns-before-0.24-denial-of-service-via-dns-response-parsing (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.