CVE-2026-116013: OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection() and decodename() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenResty lua-resty-dnsto a version that resolves this vulnerability.Fixed in 0.24
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using OpenResty lua-resty-dns before 0.24 are exposed when they query a nameserver that an attacker can control or spoof. The impact is failed DNS resolution and aborted requests rather than disclosure or modification of data.
What does an attacker need to exploit this issue?
An attacker must be able to control or spoof a queried DNS nameserver and return a DNS response with truncated resource-record headers or RDATA. No privileges or user interaction are required, but the attack complexity is high.
Is a default configuration known to be affected?
The available data does not identify any specific default configuration. Exposure depends on whether the resolver queries a nameserver an attacker can control or spoof.
What can be done if upgrading is not immediately possible?
Limit resolver queries to trusted DNS servers and prevent attackers from controlling or spoofing responses from queried nameservers. This reduces the opportunity to deliver the malformed truncated DNS records that trigger the uncaught exceptions.