Threats affecting pkg:deb/trusted_domain_project/opendmarc

CVE-2026-101278 is a medium severity vulnerability in Trusted Domain Project OpenDMARC versions 1.4.0, 1.4.1, and 1.4.2. It involves an origin validation error caused by manipulation of the PSL Wildcard Handler in the opendmarc_get_tld function. No patch or fix is currently available, and the vendor has not responded to the disclosure. Public exploit code exists, but no exploitation in the wild has been reported.

A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-100891 is a medium severity vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2. It involves an encoding error in the Internationalized Domain Name Handler component, specifically in the opendmarc_policy_query_dmarc function. This flaw can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.