lua-resty-dns CVE-2026-116013

The attacker must be able to control the authoritative/queried nameserver, or be positioned to spoof its responses (off-path spoofing requires winning the race against the legitimate reply and matching the transaction ID - this is the AT:P requirement), for a name that a victim resolves using lua-resty-dns before 0.24. The concrete trigger is a DNS reply in which a resource record's declared length exceeds the actual message bytes: short A RDATA (len != 4), short AAAA RDATA (len != 16), a record header that overruns the buffer (the added pos+9 > #buf check), excessive DNS compression pointers (the 128-pointer limit added to _decode_name), or malformed SOA/TXT string lengths. Both UDP and TCP paths are affected (the regression tests exercise tcp_query). LIMITING FACTORS: no authentication (PR:N) and no user interaction are needed, but exploitation requires attacker control or spoofing of the nameserver response (not merely network reach to the application); impact is confined to availability (aborted queries / failed name resolution), with no code execution, data exposure, or integrity impact.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, 6.3 medium) correctly scopes it as an availability-only denial of service: no confidentiality or integrity impact, and the AT:P 'attack requirement' reflects that the attacker must control or spoof the queried nameserver rather than simply reaching the service. The input provides no EPSS score and the CVE is not listed in CISA KEV, so there is no signal of widespread or confirmed active exploitation; the vuln.today Decision label is 'this_month', consistent with a real-but-not-critical priority to be patched in the normal cycle rather than an act_now/emergency. The practical risk hinges on attacker position: if the application resolves names whose authoritative server the attacker controls, exploitation is trivial (AC:L); if the attacker is off-path and must spoof UDP responses, they must win the race and guess the transaction ID, which is a meaningful barrier (this is what AT:P captures). Impact is a broken resolver:query() that aborts the request and disrupts name resolution - potentially cascading in gateways/proxies that depend on DNS - but it does not yield code execution or data exposure. Note the Tags label this 'Information Disclosure', which conflicts with the vector (VC:N) and the description; this is an availability DoS, so the information-disclosure framing should be disregarded.

An attacker who operates - or can spoof responses from - a DNS nameserver that an OpenResty/lua-resty-dns (< 0.24) application queries returns a reply containing a resource record whose declared length exceeds the actual bytes present (a truncated record header or short RDATA). When resolver:query() parses it, the missing bounds checks in parse_section()/_decode_name() cause an out-of-range read that raises an uncaught Lua exception, aborting the request and breaking name resolution for the service. A public PoC reference exists: the PR #83 regression tests craft short A/AAAA RDATA and truncated headers that trigger the failure over both UDP and TCP; it is not verified as a standalone weaponized exploit.