Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-101281 (GCVE-0-2026-101281)

Vulnerability from nvd – Published: 2026-09-29 00:45 – Updated: 2026-09-29 00:45 X_Open Source

Title

Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication

Summary

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-287 - Improper Authentication

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/411038	vdb-entrytechnical-description
https://vuldb.com/vuln/411038/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101281	third-party-advisory
https://vuldb.com/submit/918284	third-party-advisory
https://github.com/trusteddomainproject/OpenDMARC…	issue-tracking
https://github.com/trusteddomainproject/OpenDMARC…	issue-trackingpatch
https://xuyongzhe-vt.github.io/share/opendmarc-sp…	exploit
https://github.com/trusteddomainproject/OpenDMARC…	patch

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SPF Macro Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:45:11.946Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411038 | Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411038"
        },
        {
          "name": "VDB-411038 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411038/cti"
        },
        {
          "name": "CVE-2026-101281 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101281"
        },
        {
          "name": "Submit #918284 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918284"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/issues/262"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/328"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-spf-postmaster-macro.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/commit/c48a74c758677fc5272a73eff15ffdbf8afda1a6"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:13.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101281",
    "datePublished": "2026-09-29T00:45:11.946Z",
    "dateReserved": "2026-09-28T11:52:51.804Z",
    "dateUpdated": "2026-09-29T00:45:11.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101280 (GCVE-0-2026-101280)

Vulnerability from nvd – Published: 2026-09-29 00:30 – Updated: 2026-09-29 00:30

Title

Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing

Summary

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CWE

CWE-290 - Authentication Bypass by Spoofing
CWE-287 - Improper Authentication

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/411037	vdb-entrytechnical-description
https://vuldb.com/vuln/411037/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101280	third-party-advisory
https://vuldb.com/submit/918282	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-mu…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Multi-Record Set Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:30:15.504Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411037 | Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411037"
        },
        {
          "name": "VDB-411037 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411037/cti"
        },
        {
          "name": "CVE-2026-101280 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101280"
        },
        {
          "name": "Submit #918282 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918282"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101280",
    "datePublished": "2026-09-29T00:30:15.504Z",
    "dateReserved": "2026-09-28T11:52:48.230Z",
    "dateUpdated": "2026-09-29T00:30:15.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101279 (GCVE-0-2026-101279)

Vulnerability from nvd – Published: 2026-09-29 00:15 – Updated: 2026-09-29 00:15

Title

Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow

Summary

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

CWE

CWE-190 - Integer Overflow
CWE-189 - Numeric Error

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/411036	vdb-entrytechnical-description
https://vuldb.com/vuln/411036/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101279	third-party-advisory
https://vuldb.com/submit/918280	third-party-advisory
https://xuyongzhe-vt.github.io/share/dmarc-pct-in…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "DMARC Parser"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.4,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-189",
              "description": "Numeric Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:15:09.911Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411036 | Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411036"
        },
        {
          "name": "VDB-411036 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411036/cti"
        },
        {
          "name": "CVE-2026-101279 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101279"
        },
        {
          "name": "Submit #918280 | The Trusted Domain Project OpenDMARC 1.4.2 Integer Overflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918280"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:06.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101279",
    "datePublished": "2026-09-29T00:15:09.911Z",
    "dateReserved": "2026-09-28T11:52:44.734Z",
    "dateUpdated": "2026-09-29T00:15:09.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101278 (GCVE-0-2026-101278)

Vulnerability from nvd – Published: 2026-09-29 00:00 – Updated: 2026-09-29 00:00

Title

Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation

Summary

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

CWE

CWE-346 - Origin Validation Error
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/411035	vdb-entrytechnical-description
https://vuldb.com/vuln/411035/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101278	third-party-advisory
https://vuldb.com/submit/918273	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-ps…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PSL Wildcard Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:00:12.788Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411035 | Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411035"
        },
        {
          "name": "VDB-411035 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411035/cti"
        },
        {
          "name": "CVE-2026-101278 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101278"
        },
        {
          "name": "Submit #918273 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918273"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-psl-wildcard-orgdomain.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:01.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101278",
    "datePublished": "2026-09-29T00:00:12.788Z",
    "dateReserved": "2026-09-28T11:52:41.431Z",
    "dateUpdated": "2026-09-29T00:00:12.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101017 (GCVE-0-2026-101017)

Vulnerability from nvd – Published: 2026-09-28 09:00 – Updated: 2026-09-28 12:43

Title

Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition

Summary

A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:43 UTC

CWE

CWE-755 - Handling of Exceptional Conditions

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410887	vdb-entrytechnical-description
https://vuldb.com/vuln/410887/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101017	third-party-advisory
https://vuldb.com/submit/918247	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-su…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101017",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:43:42.736276Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T12:43:56.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.4,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T09:00:10.541Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410887 | Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410887"
        },
        {
          "name": "VDB-410887 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410887/cti"
        },
        {
          "name": "CVE-2026-101017 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101017"
        },
        {
          "name": "Submit #918247 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918247"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-subdomain-walk-abort.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:35.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101017",
    "datePublished": "2026-09-28T09:00:10.541Z",
    "dateReserved": "2026-09-27T11:33:10.549Z",
    "dateUpdated": "2026-09-28T12:43:56.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101016 (GCVE-0-2026-101016)

Vulnerability from nvd – Published: 2026-09-28 08:45 – Updated: 2026-09-28 10:57

Title

Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition

Summary

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 10:56 UTC

CWE

CWE-755 - Handling of Exceptional Conditions

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410886	vdb-entrytechnical-description
https://vuldb.com/vuln/410886/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101016	third-party-advisory
https://vuldb.com/submit/918242	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-ba…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101016",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T10:56:52.614606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T10:57:07.856Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.4,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T08:45:11.087Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410886 | Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410886"
        },
        {
          "name": "VDB-410886 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410886/cti"
        },
        {
          "name": "CVE-2026-101016 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101016"
        },
        {
          "name": "Submit #918242 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918242"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-bad-tag-drops-policy.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:31.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101016",
    "datePublished": "2026-09-28T08:45:11.087Z",
    "dateReserved": "2026-09-27T11:33:06.447Z",
    "dateUpdated": "2026-09-28T10:57:07.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101015 (GCVE-0-2026-101015)

Vulnerability from nvd – Published: 2026-09-28 08:30 – Updated: 2026-09-28 08:30

Title

Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

Summary

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

CWE

CWE-1289 - Improper Validation of Unsafe Equivalence in Input
CWE-20 - Improper Input Validation

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410885	vdb-entry
https://vuldb.com/vuln/410885/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101015	third-party-advisory
https://vuldb.com/submit/917216	third-party-advisory
https://weitongli.com/share/opendmarc-unicode-dot…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Domain Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1289",
              "description": "Improper Validation of Unsafe Equivalence in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T08:30:08.347Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410885 | Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/410885"
        },
        {
          "name": "VDB-410885 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410885/cti"
        },
        {
          "name": "CVE-2026-101015 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101015"
        },
        {
          "name": "Submit #917216 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917216"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-unicode-dot-bypass.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101015",
    "datePublished": "2026-09-28T08:30:08.347Z",
    "dateReserved": "2026-09-27T11:33:01.551Z",
    "dateUpdated": "2026-09-28T08:30:08.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101014 (GCVE-0-2026-101014)

Vulnerability from nvd – Published: 2026-09-28 08:15 – Updated: 2026-09-28 12:43 X_Open Source

Title

Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

Summary

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:43 UTC

CWE

CWE-193 - Off-by-One
CWE-189 - Numeric Error

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/410884	vdb-entrytechnical-description
https://vuldb.com/vuln/410884/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101014	third-party-advisory
https://vuldb.com/submit/917100	third-party-advisory
https://github.com/trusteddomainproject/OpenDMARC…	issue-trackingpatch
https://github.com/trusteddomainproject/OpenDMARC…	issue-trackingpatch
https://weitongli.com/share/opendmarc-cleanup-off…	exploit
https://github.com/trusteddomainproject/OpenDMARC…	patch

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101014",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:43:08.404808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T12:43:21.470Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "DMARC Record Parser"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "Off-by-One",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-189",
              "description": "Numeric Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T08:15:13.249Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410884 | Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410884"
        },
        {
          "name": "VDB-410884 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410884/cti"
        },
        {
          "name": "CVE-2026-101014 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101014"
        },
        {
          "name": "Submit #917100 | The Trusted Domain Project OpenDMARC 1.4.2 Out-of-Bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917100"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/188"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/344"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-cleanup-off-by-one.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:17.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101014",
    "datePublished": "2026-09-28T08:15:13.249Z",
    "dateReserved": "2026-09-27T11:32:56.615Z",
    "dateUpdated": "2026-09-28T12:43:21.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100891 (GCVE-0-2026-100891)

Vulnerability from nvd – Published: 2026-09-28 00:15 – Updated: 2026-09-28 00:15

Title

Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error

Summary

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

CWE

CWE-172 - Encoding Error

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410841	vdb-entrytechnical-description
https://vuldb.com/vuln/410841/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-100891	third-party-advisory
https://vuldb.com/submit/917215	third-party-advisory
https://weitongli.com/share/opendmarc-ulabel-not-…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Internationalized Domain Name Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-172",
              "description": "Encoding Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T00:15:14.678Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410841 | Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410841"
        },
        {
          "name": "VDB-410841 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410841/cti"
        },
        {
          "name": "CVE-2026-100891 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-100891"
        },
        {
          "name": "Submit #917215 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917215"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-ulabel-not-converted.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T10:00:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-100891",
    "datePublished": "2026-09-28T00:15:14.678Z",
    "dateReserved": "2026-09-27T07:55:14.732Z",
    "dateUpdated": "2026-09-28T00:15:14.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100890 (GCVE-0-2026-100890)

Vulnerability from nvd – Published: 2026-09-28 00:00 – Updated: 2026-09-28 12:55

Title

Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference

Summary

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:55 UTC

CWE

CWE-476 - NULL Pointer Dereference
CWE-404 - Denial of Service

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410840	vdb-entrytechnical-description
https://vuldb.com/vuln/410840/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-100890	third-party-advisory
https://vuldb.com/submit/917188	third-party-advisory
https://weitongli.com/share/opendmarc-ip6-wild-po…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100890",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:55:04.151218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T12:55:20.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SPF Parser"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T00:00:12.540Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410840 | Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410840"
        },
        {
          "name": "VDB-410840 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410840/cti"
        },
        {
          "name": "CVE-2026-100890 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-100890"
        },
        {
          "name": "Submit #917188 | The Trusted Domain Project OpenDMARC 1.4.2 NULL Pointer Dereference",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917188"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-ip6-wild-pointer.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T10:00:20.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-100890",
    "datePublished": "2026-09-28T00:00:12.540Z",
    "dateReserved": "2026-09-27T07:55:10.374Z",
    "dateUpdated": "2026-09-28T12:55:20.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101281 (GCVE-0-2026-101281)

Vulnerability from cvelistv5 – Published: 2026-09-29 00:45 – Updated: 2026-09-29 00:45 X_Open Source

Title

Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication

Summary

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-287 - Improper Authentication

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/411038	vdb-entrytechnical-description
https://vuldb.com/vuln/411038/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101281	third-party-advisory
https://vuldb.com/submit/918284	third-party-advisory
https://github.com/trusteddomainproject/OpenDMARC…	issue-tracking
https://github.com/trusteddomainproject/OpenDMARC…	issue-trackingpatch
https://xuyongzhe-vt.github.io/share/opendmarc-sp…	exploit
https://github.com/trusteddomainproject/OpenDMARC…	patch

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SPF Macro Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:45:11.946Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411038 | Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411038"
        },
        {
          "name": "VDB-411038 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411038/cti"
        },
        {
          "name": "CVE-2026-101281 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101281"
        },
        {
          "name": "Submit #918284 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918284"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/issues/262"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/328"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-spf-postmaster-macro.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/commit/c48a74c758677fc5272a73eff15ffdbf8afda1a6"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:13.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101281",
    "datePublished": "2026-09-29T00:45:11.946Z",
    "dateReserved": "2026-09-28T11:52:51.804Z",
    "dateUpdated": "2026-09-29T00:45:11.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101280 (GCVE-0-2026-101280)

Vulnerability from cvelistv5 – Published: 2026-09-29 00:30 – Updated: 2026-09-29 00:30

Title

Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing

Summary

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CWE

CWE-290 - Authentication Bypass by Spoofing
CWE-287 - Improper Authentication

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/411037	vdb-entrytechnical-description
https://vuldb.com/vuln/411037/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101280	third-party-advisory
https://vuldb.com/submit/918282	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-mu…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Multi-Record Set Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:30:15.504Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411037 | Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411037"
        },
        {
          "name": "VDB-411037 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411037/cti"
        },
        {
          "name": "CVE-2026-101280 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101280"
        },
        {
          "name": "Submit #918282 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918282"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101280",
    "datePublished": "2026-09-29T00:30:15.504Z",
    "dateReserved": "2026-09-28T11:52:48.230Z",
    "dateUpdated": "2026-09-29T00:30:15.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101279 (GCVE-0-2026-101279)

Vulnerability from cvelistv5 – Published: 2026-09-29 00:15 – Updated: 2026-09-29 00:15

Title

Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow

Summary

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

CWE

CWE-190 - Integer Overflow
CWE-189 - Numeric Error

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/411036	vdb-entrytechnical-description
https://vuldb.com/vuln/411036/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101279	third-party-advisory
https://vuldb.com/submit/918280	third-party-advisory
https://xuyongzhe-vt.github.io/share/dmarc-pct-in…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "DMARC Parser"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.4,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-189",
              "description": "Numeric Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:15:09.911Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411036 | Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411036"
        },
        {
          "name": "VDB-411036 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411036/cti"
        },
        {
          "name": "CVE-2026-101279 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101279"
        },
        {
          "name": "Submit #918280 | The Trusted Domain Project OpenDMARC 1.4.2 Integer Overflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918280"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:06.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101279",
    "datePublished": "2026-09-29T00:15:09.911Z",
    "dateReserved": "2026-09-28T11:52:44.734Z",
    "dateUpdated": "2026-09-29T00:15:09.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101278 (GCVE-0-2026-101278)

Vulnerability from cvelistv5 – Published: 2026-09-29 00:00 – Updated: 2026-09-29 00:00

Title

Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation

Summary

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

CWE

CWE-346 - Origin Validation Error
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/411035	vdb-entrytechnical-description
https://vuldb.com/vuln/411035/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101278	third-party-advisory
https://vuldb.com/submit/918273	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-ps…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "PSL Wildcard Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T00:00:12.788Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-411035 | Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/411035"
        },
        {
          "name": "VDB-411035 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/411035/cti"
        },
        {
          "name": "CVE-2026-101278 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101278"
        },
        {
          "name": "Submit #918273 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918273"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-psl-wildcard-orgdomain.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-28T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-28T13:58:01.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101278",
    "datePublished": "2026-09-29T00:00:12.788Z",
    "dateReserved": "2026-09-28T11:52:41.431Z",
    "dateUpdated": "2026-09-29T00:00:12.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101017 (GCVE-0-2026-101017)

Vulnerability from cvelistv5 – Published: 2026-09-28 09:00 – Updated: 2026-09-28 12:43

Title

Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition

Summary

A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:43 UTC

CWE

CWE-755 - Handling of Exceptional Conditions

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410887	vdb-entrytechnical-description
https://vuldb.com/vuln/410887/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101017	third-party-advisory
https://vuldb.com/submit/918247	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-su…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101017",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:43:42.736276Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T12:43:56.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.4,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T09:00:10.541Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410887 | Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410887"
        },
        {
          "name": "VDB-410887 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410887/cti"
        },
        {
          "name": "CVE-2026-101017 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101017"
        },
        {
          "name": "Submit #918247 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918247"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-subdomain-walk-abort.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:35.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101017",
    "datePublished": "2026-09-28T09:00:10.541Z",
    "dateReserved": "2026-09-27T11:33:10.549Z",
    "dateUpdated": "2026-09-28T12:43:56.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101016 (GCVE-0-2026-101016)

Vulnerability from cvelistv5 – Published: 2026-09-28 08:45 – Updated: 2026-09-28 10:57

Title

Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition

Summary

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 10:56 UTC

CWE

CWE-755 - Handling of Exceptional Conditions

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410886	vdb-entrytechnical-description
https://vuldb.com/vuln/410886/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101016	third-party-advisory
https://vuldb.com/submit/918242	third-party-advisory
https://xuyongzhe-vt.github.io/share/opendmarc-ba…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

yongzhe_xu (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101016",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T10:56:52.614606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T10:57:07.856Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yongzhe_xu (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.4,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T08:45:11.087Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410886 | Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410886"
        },
        {
          "name": "VDB-410886 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410886/cti"
        },
        {
          "name": "CVE-2026-101016 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101016"
        },
        {
          "name": "Submit #918242 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/918242"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://xuyongzhe-vt.github.io/share/opendmarc-bad-tag-drops-policy.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:31.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101016",
    "datePublished": "2026-09-28T08:45:11.087Z",
    "dateReserved": "2026-09-27T11:33:06.447Z",
    "dateUpdated": "2026-09-28T10:57:07.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101015 (GCVE-0-2026-101015)

Vulnerability from cvelistv5 – Published: 2026-09-28 08:30 – Updated: 2026-09-28 08:30

Title

Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

Summary

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

CWE

CWE-1289 - Improper Validation of Unsafe Equivalence in Input
CWE-20 - Improper Input Validation

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410885	vdb-entry
https://vuldb.com/vuln/410885/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101015	third-party-advisory
https://vuldb.com/submit/917216	third-party-advisory
https://weitongli.com/share/opendmarc-unicode-dot…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Domain Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1289",
              "description": "Improper Validation of Unsafe Equivalence in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T08:30:08.347Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410885 | Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/410885"
        },
        {
          "name": "VDB-410885 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410885/cti"
        },
        {
          "name": "CVE-2026-101015 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101015"
        },
        {
          "name": "Submit #917216 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917216"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-unicode-dot-bypass.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101015",
    "datePublished": "2026-09-28T08:30:08.347Z",
    "dateReserved": "2026-09-27T11:33:01.551Z",
    "dateUpdated": "2026-09-28T08:30:08.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-101014 (GCVE-0-2026-101014)

Vulnerability from cvelistv5 – Published: 2026-09-28 08:15 – Updated: 2026-09-28 12:43 X_Open Source

Title

Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

Summary

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:43 UTC

CWE

CWE-193 - Off-by-One
CWE-189 - Numeric Error

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/410884	vdb-entrytechnical-description
https://vuldb.com/vuln/410884/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-101014	third-party-advisory
https://vuldb.com/submit/917100	third-party-advisory
https://github.com/trusteddomainproject/OpenDMARC…	issue-trackingpatch
https://github.com/trusteddomainproject/OpenDMARC…	issue-trackingpatch
https://weitongli.com/share/opendmarc-cleanup-off…	exploit
https://github.com/trusteddomainproject/OpenDMARC…	patch

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101014",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:43:08.404808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T12:43:21.470Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "DMARC Record Parser"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "Off-by-One",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-189",
              "description": "Numeric Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T08:15:13.249Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410884 | Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410884"
        },
        {
          "name": "VDB-410884 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410884/cti"
        },
        {
          "name": "CVE-2026-101014 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-101014"
        },
        {
          "name": "Submit #917100 | The Trusted Domain Project OpenDMARC 1.4.2 Out-of-Bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917100"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/188"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/344"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-cleanup-off-by-one.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T13:38:17.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-101014",
    "datePublished": "2026-09-28T08:15:13.249Z",
    "dateReserved": "2026-09-27T11:32:56.615Z",
    "dateUpdated": "2026-09-28T12:43:21.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100891 (GCVE-0-2026-100891)

Vulnerability from cvelistv5 – Published: 2026-09-28 00:15 – Updated: 2026-09-28 00:15

Title

Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error

Summary

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

7.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

CWE

CWE-172 - Encoding Error

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410841	vdb-entrytechnical-description
https://vuldb.com/vuln/410841/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-100891	third-party-advisory
https://vuldb.com/submit/917215	third-party-advisory
https://weitongli.com/share/opendmarc-ulabel-not-…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Internationalized Domain Name Handler"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-172",
              "description": "Encoding Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T00:15:14.678Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410841 | Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410841"
        },
        {
          "name": "VDB-410841 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410841/cti"
        },
        {
          "name": "CVE-2026-100891 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-100891"
        },
        {
          "name": "Submit #917215 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917215"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-ulabel-not-converted.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T10:00:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-100891",
    "datePublished": "2026-09-28T00:15:14.678Z",
    "dateReserved": "2026-09-27T07:55:14.732Z",
    "dateUpdated": "2026-09-28T00:15:14.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-100890 (GCVE-0-2026-100890)

Vulnerability from cvelistv5 – Published: 2026-09-28 00:00 – Updated: 2026-09-28 12:55

Title

Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference

Summary

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 12:55 UTC

CWE

CWE-476 - NULL Pointer Dereference
CWE-404 - Denial of Service

Assigner

VulDB mitre root

References

5 references

URL	Tags
https://vuldb.com/vuln/410840	vdb-entrytechnical-description
https://vuldb.com/vuln/410840/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-100890	third-party-advisory
https://vuldb.com/submit/917188	third-party-advisory
https://weitongli.com/share/opendmarc-ip6-wild-po…	exploit

Impacted products

1 product

Vendor	Product	Version
Trusted Domain Project	OpenDMARC	Affected: 1.4.0 Affected: 1.4.1 Affected: 1.4.2 cpe:2.3:a:trusted_domain_project:opendmarc::::::::

Credits

WeitongLi (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100890",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T12:55:04.151218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T12:55:20.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SPF Parser"
          ],
          "product": "OpenDMARC",
          "vendor": "Trusted Domain Project",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "affected",
              "version": "1.4.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "WeitongLi (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T00:00:12.540Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-410840 | Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/410840"
        },
        {
          "name": "VDB-410840 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/410840/cti"
        },
        {
          "name": "CVE-2026-100890 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-100890"
        },
        {
          "name": "Submit #917188 | The Trusted Domain Project OpenDMARC 1.4.2 NULL Pointer Dereference",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/917188"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://weitongli.com/share/opendmarc-ip6-wild-pointer.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-27T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-27T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-27T10:00:20.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-100890",
    "datePublished": "2026-09-28T00:00:12.540Z",
    "dateReserved": "2026-09-27T07:55:10.374Z",
    "dateUpdated": "2026-09-28T12:55:20.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

20 vulnerabilities found for OpenDMARC by Trusted Domain Project

CVE-2026-101281 (GCVE-0-2026-101281)

CVE-2026-101280 (GCVE-0-2026-101280)

CVE-2026-101279 (GCVE-0-2026-101279)

CVE-2026-101278 (GCVE-0-2026-101278)

CVE-2026-101017 (GCVE-0-2026-101017)

CVE-2026-101016 (GCVE-0-2026-101016)

CVE-2026-101015 (GCVE-0-2026-101015)

CVE-2026-101014 (GCVE-0-2026-101014)

CVE-2026-100891 (GCVE-0-2026-100891)

CVE-2026-100890 (GCVE-0-2026-100890)

CVE-2026-101281 (GCVE-0-2026-101281)

CVE-2026-101280 (GCVE-0-2026-101280)

CVE-2026-101279 (GCVE-0-2026-101279)

CVE-2026-101278 (GCVE-0-2026-101278)

CVE-2026-101017 (GCVE-0-2026-101017)

CVE-2026-101016 (GCVE-0-2026-101016)

CVE-2026-101015 (GCVE-0-2026-101015)

CVE-2026-101014 (GCVE-0-2026-101014)

CVE-2026-100891 (GCVE-0-2026-100891)

CVE-2026-100890 (GCVE-0-2026-100890)