CVE-2026-101016
Received Received - Intake

OpenDMARC Policy Parsing Exception Handling Flaw

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101016
EUVD
EUVD-2026-88176

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trusted_domain_project opendmarc to 1.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenDMARC versions up to 1.4.2 due to a typo in optional DMARC record tags like fo=9. OpenDMARC incorrectly treats unparseable tags as fatal errors, causing it to return a permerror status instead of enforcing the p=reject policy. This allows forged emails to bypass DMARC checks.

Detection Guidance

Check OpenDMARC version with 'opendmarc --version' or 'dpkg -l | grep opendmarc'. Inspect DMARC records for typos in optional tags like fo=9. Monitor logs for permerror statuses during DMARC policy enforcement.

Impact Analysis

Attackers can exploit this to deliver forged emails that appear legitimate, bypassing DMARC's p=reject policy. This could lead to phishing attacks, unauthorized access, or data breaches if the forged emails are used to trick recipients into disclosing sensitive information.

Compliance Impact

This vulnerability may violate compliance requirements that mandate email authentication and integrity, such as GDPR's data protection principles or HIPAA's security rules. Failure to enforce DMARC policies could result in unauthorized email access, compromising confidentiality and integrity of communications.

Mitigation Strategies

Update OpenDMARC to the latest version that fixes parsing issues. Review and correct DMARC records to remove typos in optional tags. Configure OpenDMARC to ignore malformed optional tags per RFC 7489.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart