TI-2026-65172 Aliases CVE-2026-101278 GHSA-f9p6-hxqg-x7r4

Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation

MEDIUM 57CWE-345Published 2026-09-29 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00133 2nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Trusted Domain Project	OpenDMARC	1.4.0; 1.4.1; 1.4.2	—	No fix listed	CNA

OpenDMARC VendorTrusted Domain Project Affected 1.4.0; 1.4.1; 1.4.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trusted_domain_project:opendmarc::::::::	—	—	Trusted Domain Project

cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:* Versions — — ·Trusted Domain Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-101278
2026-10-03 Alias added: GHSA-f9p6-hxqg-x7r4

References

Exploit 1

https://xuyongzhe-vt.github.io/share/opendmarc-psl-wildcard-orgdomain.html

TI-2026-65175 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication CVSS 4.0MEDIUM 6.9
TI-2026-65174 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing CVSS 4.0MEDIUM 6.9
TI-2026-65173 Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow CVSS 4.0MEDIUM 6.9
TI-2026-65171 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source CVSS 4.0MEDIUM 6.9
TI-2026-65064 Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition CVSS 4.0MEDIUM 6.9
TI-2026-65063 Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition CVSS 4.0MEDIUM 6.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences