PT-2026-122594
CVE-2026-116013
·
Published
2026-10-24
·
Updated
2026-10-24
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OpenResty lua-resty-dns versions prior to 0.24
Description
Improper input validation occurs in the
parse section() and decode name() functions, where resource record lengths are not checked against the received message. An attacker who controls or spoofs a queried nameserver can send truncated record headers or RDATA, causing uncaught Lua exceptions in resolver:query(). This results in aborted requests and the failure of name resolution.Recommendations
Update OpenResty lua-resty-dns to version 0.24 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾