CVE-2026-116013Low· 3.7▾ SunlitOpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a q…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution.
lua-resty-dns < 0.24Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5367High· 8.6A flaw was found in OVN (Open Virtual Network)
CVE-2026-114646Medium· 6.5NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
CVE-2026-87864NoneIMAP APPEND plus CRLF conversion command injection
CVE-2026-105960Medium· 5.5HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency
CVE-2026-98600Medium· 6.5kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (CVE-2026-98600)
CVE-2026-6432Medium· 5.3Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage