p PatchFirst

CVE-2026-116013

CVE-2026-116013 · OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • lua-resty-dns

    Versions
    • ≥ 0, < 0.24: Affected (custom)

    Update to 0.24

  • lua-nginx-dns Debian:12

    Versions
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Debian:13

    Versions
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Debian:14

    Versions
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:16.04:LTS

    Versions
    • 0.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:18.04:LTS

    Versions
    • 0.19-1
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:20.04:LTS

    Versions
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:22.04:LTS

    Versions
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:24.04:LTS

    Versions
    • 0.20-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:26.10

    Versions
    • 0.20-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-nginx-dns Ubuntu:26.04:LTS

    Versions
    • 0.20-1
    • 0.20-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →