CVE-2026-116013 in lua-resty-dns
Summary
by MITRE • 10/24/2026
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in OpenResty lua-resty-dns prior to version 0.24 represents a critical flaw in the input validation logic of its DNS parsing mechanisms. Specifically, the functions parse_section and _decode_name fail to rigorously verify that resource record lengths align with the actual size of the received DNS message payload. This deficiency allows an attacker who controls or can spoof the queried nameserver to craft maliciously formatted DNS responses containing truncated record headers or improperly sized Resource Data fields. The core technical failure lies in the absence of boundary checks before attempting to decode these records, which leads to memory access violations within the Lua environment when the parser attempts to read beyond the allocated buffer limits defined by the message structure.
From an operational perspective, this improper input validation results in uncaught exceptions being raised during the execution of resolver:query operations. When a truncated or malformed record is processed, the Lua runtime aborts the current request and terminates name resolution for that query entirely. This behavior effectively creates a denial-of-service condition against clients relying on OpenResty instances configured with lua-resty-dns for DNS lookups. Attackers can exploit this by sending specially crafted DNS responses to trigger these exceptions, thereby disrupting service availability without needing to compromise the underlying server infrastructure directly. The impact is particularly severe in environments where high availability and consistent name resolution are critical, as it allows remote adversaries to cause localized outages through simple packet manipulation or spoofing attacks against open resolvers.
This vulnerability aligns with CWE-20 Improper Input Validation, as the software fails to verify that input data meets expected structural constraints before processing. Furthermore, in the context of the MITRE ATT&CK framework, this exploit technique relates to T1498 Network Denial of Service and potentially T1567 Exfiltration Over Web Services if used in conjunction with other techniques for disrupting communication channels. The lack of robust length checking is a common pitfall in network protocol parsers where performance optimizations sometimes bypass strict validation steps, leaving the system vulnerable to malformed packet attacks that crash application-level services rather than just causing minor parsing errors.
To mitigate this vulnerability, organizations must upgrade lua-resty-dns to version 0.24 or later, which includes patches for these input validation checks in parse_section and _decode_name. Until an update can be applied, administrators should consider implementing network-level controls such as DNS response rate limiting or restricting access to the OpenResty instances from untrusted networks to reduce exposure to spoofed responses. Additionally, enabling strict error handling within Lua scripts that utilize this library may help catch exceptions gracefully rather than allowing them to abort entire requests, although upgrading remains the only definitive remediation for the underlying parsing flaw. Regular auditing of DNS query configurations and monitoring for unusual spikes in resolver errors can also aid in detecting potential exploitation attempts in real-time.