Lua Resty Dns
Monthly
Malformed DNS replies can crash the parser in lua-resty-dns before 0.24, causing resolver:query() to raise an uncaught Lua exception that aborts the request and breaks name resolution for that worker. The flaw sits in parse_section() and _decode_name(), which trust the resource-record lengths declared in the received message and previously truncated over-long TXT/SOA data instead of rejecting it; a short A RDATA, short AAAA RDATA, truncated record header, or excessive compression pointers is enough to trigger the failure. Exploitation requires the attacker to control the queried authoritative nameserver or to spoof its response (off-path spoofing also has to win the transaction-ID race), so no authentication or user interaction is needed but network position against the resolver's upstream is; impact is limited to availability (aborted lookups, failed resolution) with no code execution, data exposure, or integrity loss. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available in v0.24.
Malformed DNS replies can crash the parser in lua-resty-dns before 0.24, causing resolver:query() to raise an uncaught Lua exception that aborts the request and breaks name resolution for that worker. The flaw sits in parse_section() and _decode_name(), which trust the resource-record lengths declared in the received message and previously truncated over-long TXT/SOA data instead of rejecting it; a short A RDATA, short AAAA RDATA, truncated record header, or excessive compression pointers is enough to trigger the failure. Exploitation requires the attacker to control the queried authoritative nameserver or to spoof its response (off-path spoofing also has to win the transaction-ID race), so no authentication or user interaction is needed but network position against the resolver's upstream is; impact is limited to availability (aborted lookups, failed resolution) with no code execution, data exposure, or integrity loss. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available in v0.24.