Description
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Origin Validation Error
Action: Apply Patch
AI Analysis

Impact

A logic flaw in OpenDMARC’s PSL wildcard handling function opendmarc_get_tld can lead to an origin validation error when manipulated. The flaw may allow the system to incorrectly accept an origin that should be rejected. The CVE notes that the exploit is publicly available and can be launched from a remote location.

Affected Systems

Trusted Domain Project OpenDMARC versions up to and including 1.4.2 are affected. All installations that rely on the PSL wildcard component and have not applied a later release are susceptible.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, reflecting a moderate risk. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Because the exploit is publicly available and can be launched remotely, the risk of exploitation is higher than might be inferred from the moderate severity alone.

Generated by OpenCVE AI on September 29, 2026 at 02:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest OpenDMARC release that removes the flaw in the PSL wildcard handling.
  • If upgrading immediately is not feasible, disable the PSL wildcard feature in the configuration to eliminate the vulnerable code path.
  • Enable detailed logging of origin validation outcomes to detect and investigate anomalous behavior related to this vulnerability.

Generated by OpenCVE AI on September 29, 2026 at 02:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation
First Time appeared Trusted Domain Project
Trusted Domain Project opendmarc
Weaknesses CWE-345
CWE-346
CPEs cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*
Vendors & Products Trusted Domain Project
Trusted Domain Project opendmarc
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Trusted Domain Project Opendmarc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T15:23:54.171Z

Reserved: 2026-09-28T11:52:41.431Z

Link: CVE-2026-101278

cve-icon Vulnrichment

Updated: 2026-10-01T15:23:47.626Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T01:16:43.787

Modified: 2026-10-01T16:17:32.143

Link: CVE-2026-101278

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T03:00:12Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity

  • CWE-346

    Origin Validation Error