Improper Input Validation in OpenResty lua-resty-dns Affects DNS Resolution
CVE-2026-116013

6.3MEDIUM

Key Information:

Vendor

Openresty

Status
Lua-resty-dns
Vendor
CVE Published:
24 October 2026

What is CVE-2026-116013?

The OpenResty lua-resty-dns library versions prior to 0.24 contain an improper input validation vulnerability in the functions parse_section() and _decode_name(). This flaw permits attackers who control or spoof a queried nameserver to send malformed messages. Such messages may include truncated record headers or RDATA. As a result, uncaught Lua exceptions may occur within resolver:query(), leading to request aborts and subsequent name resolution failures. This vulnerability poses a risk to the stability and reliability of DNS resolutions.

Affected Version(s)

lua-resty-dns 0 < 0.24

References

https://github.com/openresty/lua-resty-dns/pull/83
patchissue-tracking
https://github.com/openresty/lua-resty-dns/commit/b68eaec...
patch
https://github.com/openresty/lua-resty-dns/blob/v0.23/lib...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Siyang Wu
.