Openresty - vulnerabilities (CVEs)

9 CVEs in 3 products, 1 in the last 30 days, newest from 2026-10-24.

Products

Openresty - 6 CVEs
Lua-nginx-module - 2 CVEs
Lua-resty-dns - 1 CVEs

Newest CVEs of Openresty

CVE-2026-116013 - CVSS 6.3 (medium), 2026-10-24: OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource…
CVE-2026-55233 - CVSS 7.5 (high), 2026-07-10: OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2…
CVE-2024-33452 - CVSS 7.7 (high), 2025-04-22: An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
CVE-2024-39702 - CVSS 5.9 (medium), 2024-07-23: In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service)…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2021-23017 - CVSS 7.7 (high), 2021-06-01: A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory…
CVE-2020-36309 - CVSS 5.3 (medium), 2021-04-06: ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a…
CVE-2020-11724 - CVSS 7.5 (high), 2020-04-12: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
CVE-2018-9230 - CVSS 9.8 (critical), 2018-04-02: In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond…