CVE-2026-101278CWE-345CWE-346

CVE-2026-101278

Medium · published September 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead to origin validation error. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00133 · 2.6th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-346 · Origin Validation Error
Published
2026-09-29T05:16Z
References (5)
https://vuldb.com/cve/CVE-2026-101278 · [email protected]https://vuldb.com/submit/918273 · [email protected]https://vuldb.com/vuln/411035 · [email protected]https://vuldb.com/vuln/411035/cti · [email protected]https://xuyongzhe-vt.github.io/share/opendmarc-psl-wildcard-orgdomain.html · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 29 SEP 00:00Z
    Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation
    cvelistv5