lua-resty-limit-traffic

名称 lua-resty-limit-traffic - 用于在 OpenResty/ngxlua 中限制和控制流量的 Lua 库 目录 名称 状态 示例 描述 安装 社区 英文邮件列表 中文邮件列表 Bug 与补丁 作者 版权与许可证 参见 状态 这个库已经可以使用，尽管仍处于高度实验阶段。 Lua API 仍处于变动之中，并且可能在不久的将来恕不另行通知地发生变化。 示例 root@kitploit: demonstrate the usage of the resty.limit.req module alone! http luashareddict mylimitreqstor...

lua-resty-waf

名称 lua-resty-waf - 基于 OpenResty 技术栈构建的高性能 WAF 目录 名称 状态 描述 要求 性能 安装 概要 公共函数 lua-resty-waf.loadsecrules lua-resty-waf.init 公共方法 lua-resty-waf:new lua-resty-waf:setoption lua-resty-waf:setvar lua-resty-waf:sieverule lua-resty-waf:exec lua-resty-waf:writelogevents 选项 addruleset addrulesetstring...

lua-ffi-libinjection

名称 lua-resty-libinjection - libinjection 的 LuaJIT FFI 绑定 状态 该库正在积极开发中，且已可用于生产环境 描述 该库为 libinjection 提供 FFI 绑定，libinjection 是一个 SQL/SQLi 和 XSS 分词器及分析器。 安装 像安装其他任何 OpenResty lua 模块一样安装此库。libinjection 共享对象文件必须位于你的 luapackagecpath 中，因此你应该将 .so 文件符号链接或复制到适当的位置。 概要 root@kitploit: accessbyluablock local...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

nginx-cve-2026-42945-poc

CVE-2026-42945 — NGINX Rewrite Module 堆缓冲区溢出 → RCE RCE 已确认成功 — 通过堆溢出 + GDB 进程注入，在 NGINX / OpenResty worker 进程中执行任意命令。 快速开始 root@kitploit: 一键构建 NGINX 镜像 + 执行 RCE 测试 ./run.sh nginx 一键构建 OpenResty 镜像 + 执行 RCE 测试 ./run.sh openresty 自定义命令 ./run.sh nginx 'cat /etc/passwd' ./run.sh openresty 'whoami' 漏洞...

CVE-2026-63177

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

CVE-2026-63177

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...

Photon OS 5.0: Openresty PHSA-2023-5.0-91-0056

An update of the openresty package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0056. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Openresty PHSA-2024-5.0-91-0185

An update of the openresty package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0185. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-55233

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...

CVE-2026-55233

OpenResty vulnerable versions: 1.29.2.1–1.29.2.4. A PROXY protocol v2 header construction in the stream patch can cause an out-of-bounds write, crashing the worker and causing a denial of service. This affects only configurations that enable PROXY protocol v2 for upstream connections. The issue i...

CVE-2026-55233 OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...

CVE-2026-55233 OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...

CVE-2026-55233

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the...

PT-2026-57280

Name of the Vulnerable Software and Affected Versions OpenResty versions 1.29.2.1 through 1.29.2.4 Description An out-of-bounds write occurs in the upstream PROXY protocol v2 implementation. When the platform is configured to send PROXY protocol version 2 headers to upstream servers, the process ...

CVE-2026-45406

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename...

EUVD-2026-39803

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename...

CVE-2026-45406 Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename...

CVE-2026-45406

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename...