CVE-2026-116013

The record

OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.

Affected packages

Related vulnerabilities

• CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows… CWE-130
• CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived from the… CWE-130
• CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked… CWE-130
• CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length… CWE-130
• CVE-2026-114646 A data-validation flaw exists in the BSON handling and binary serialization path of the… CWE-130