CVE-2026-116013Low· 3.7▾ SunlitOpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a q…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
lua-resty-dns < 0.24Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5367High· 8.6A flaw was found in OVN (Open Virtual Network)
CVE-2026-114597High· 7.5Improper handling of length parameter inconsistency in EPICS Base
CVE-2026-114646Medium· 6.5NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
CVE-2026-87864NoneIMAP APPEND plus CRLF conversion command injection
CVE-2026-105960Medium· 5.5HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
CVE-2026-98600Medium· 6.5kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (CVE-2026-98600)