CVE-2026-100890
MediumCVSS 5.3Summary
A null pointer dereference vulnerability was found in OpenDMARC up to 1.4.2 in the opendmarc_spf_ipv6_explode function. Manipulating the cp argument causes the issue. The attack can be initiated remotely and the exploit is published.
Risk Assessment
Null pointer dereference can lead to service crashes (DoS). The public exploit allows remote exploitation.
Recommendation
Update OpenDMARC to the latest version if available, or apply patches. If not possible, consider restricting access to the service.
Other vulnerabilities in OpenDMARC
See all- CVE-2026-101017Medium
A vulnerability in OpenDMARC up to 1.4.2 affects the strcasecmp function in libopendmarc/opendmarc_policy.c, leading to improper handling of exceptional conditions. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-101016Medium
A vulnerability in OpenDMARC up to 1.4.2 affects the opendmarc_policy_parse_dmarc function in libopendmarc/opendmarc_policy.c. Manipulation of arguments like fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to improper handling of exceptional conditions. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-101015High
A flaw was found in Trusted Domain Project OpenDMARC up to 1.4.2 in unknown functionality of policy.c in the Domain Handler component. Manipulation leads to improper validation of unsafe equivalence, and the attack can be launched remotely. The exploit has been published and may be used.
- CVE-2026-101014High
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2 in the function opendmarc_util_cleanup in libopendmarc/opendmarc_util.c of the DMARC Record Parser component. Manipulation results in an off-by-one, and the attack may be initiated remotely. The exploit is public and the patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae.
- CVE-2026-100891High
Vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 in the opendmarc_policy_query_dmarc function in libopendmarc/opendmarc_policy.c of the Internationalized Domain Name Handler component. Manipulation leads to encoding error. Remote attack possible, exploit publicly disclosed.
Original NVD description (English source)
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS