CVE-2026-116013 OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116013?
CVE-2026-116013 is a medium-severity vulnerability in openresty lua-resty-dns, published on 24 Oct 2026.
Official description
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
Weakness: CWE-130
Which versions are affected by CVE-2026-116013?
How do I fix CVE-2026-116013?
No fix has been published for CVE-2026-116013 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116013 being exploited?
There is no known exploitation of CVE-2026-116013 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116013, GHSA-879w-j376-3fgq, UBUNTU-CVE-2026-116013.