Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck

CVE-2026-116013OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

Low 3.7

In plain English

A low-severity security flaw in lua-resty-dns from openresty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	lua-nginx-dns	no fix listed	DEBIAN-CVE-2026-116013
Debian:13	lua-nginx-dns	no fix listed	DEBIAN-CVE-2026-116013
Debian:14	lua-nginx-dns	no fix listed	DEBIAN-CVE-2026-116013
Ubuntu:22.04:LTS	lua-nginx-dns	no fix listed	UBUNTU-CVE-2026-116013
Ubuntu:24.04:LTS	lua-nginx-dns	no fix listed	UBUNTU-CVE-2026-116013
Ubuntu:26.04:LTS	lua-nginx-dns	no fix listed	UBUNTU-CVE-2026-116013
Ubuntu:26.10	lua-nginx-dns	no fix listed	UBUNTU-CVE-2026-116013

Affected products (as reported)

Vendor	Product	Versions
openresty	lua-resty-dns	0 – before 0.24

Weakness: CWE-130 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/openresty/lua-resty-dns/pull/83 patch, issue-tracking
https://github.com/openresty/lua-resty-dns/commit/b68eaecbf7997ac71c08ba56032b1f45438bd758 patch
https://github.com/openresty/lua-resty-dns/blob/v0.23/lib/resty/dns/resolver.lua#L396-L442 technical-description
https://github.com/openresty/lua-resty-dns/tree/v0.24 release-notes
VulnCheck Advisory: OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing third-party-advisory