Openresty is a high-performance web-application server and reverse-proxy platform built on Nginx and Lua scripting that occupies a critical request-handling role in web infrastructure, and despite a narrow product footprint its widespread deployment as a gateway component gives its vulnerabilities outsized impact. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated tendency toward critical severity and confirmed in-the-wild exploitation, alongside a strong propensity for public exploit availability. The exposure recurs across its core Openresty server and Lua-Nginx module through weakness classes centered on HTTP request/response smuggling, SQL injection, algorithmic complexity issues, and off-by-one errors that reflect the intersection of protocol parsing, scripting integration, and memory safety demands. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openresty over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2021-23017HIGH A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in | Jun 1, 2021 | 7.7 | 65 | NO | YES |
CVE-2018-9230CRITICAL In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which | Apr 2, 2018 | 9.8 | 38 | NO | NO |
CVE-2026-55233HIGH OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When O | Jul 10, 2026 | 7.5 | 35 | NO | NO |
CVE-2020-11724HIGH An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. | Apr 12, 2020 | 7.5 | 26 | NO | NO |
CVE-2024-33452HIGH An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. | Apr 22, 2025 | 7.7 | 23 | NO | NO |
CVE-2020-36309MEDIUM ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header. | Apr 6, 2021 | 5.3 | 20 | NO | NO |
CVE-2024-39702MEDIUM In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker cou | Jul 23, 2024 | 5.9 | 18 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openresty.
Media articles that mention a CVE ID that affects a product developed by Openresty — matched by CVE ID, not by vendor name.