UBUNTU-CVE-2026-116013: Input Validation

Published Oct 24, 2026

Updated

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parsesection() and decodename() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.

Affected Software

7 affected components

ubuntu/lua-nginx-dns*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenResty lua-resty-dns to a version that resolves this vulnerability.
Fixed in 0.24

Event History

Oct 24, 2026

CVE Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to trigger the issue?

The attacker must be able to control or spoof a nameserver queried by the affected resolver. No privileges or user interaction are required.

What is the expected security impact?

The impact is limited to availability: malformed truncated DNS records can abort resolver requests and disrupt name resolution. The provided severity data indicates no confidentiality or integrity impact.

UBUNTU-CVE-2026-116013: Input Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to trigger the issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the issue?

What is the expected security impact?