CVE-2026-101015

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101015", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-27T11:33:01.551Z", "datePublished": "2026-09-28T08:30:08.347Z", "dateUpdated": "2026-10-01T14:10:12.503Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-28T08:30:08.347Z"}, "title": "Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1289", "lang": "en", "description": "Improper Validation of Unsafe Equivalence in Input"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation"}]}], "affected": [{"vendor": "Trusted Domain Project", "product": "OpenDMARC", "versions": [{"version": "1.4.0", "status": "affected"}, {"version": "1.4.1", "status": "affected"}, {"version": "1.4.2", "status": "affected"}], "cpes": ["cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"], "modules": ["Domain Handler"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-09-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-27T13:38:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "WeitongLi (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/410885", "name": "VDB-410885 | Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/410885/cti", "name": "VDB-410885 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-101015", "name": "CVE-2026-101015 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/917216", "name": "Submit #917216 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication", "tags": ["third-party-advisory"]}, {"url": "https://weitongli.com/share/opendmarc-unicode-dot-bypass.html", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T14:09:50.063007Z", "id": "CVE-2026-101015", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:10:12.503Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101015", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T14:09:50.063007Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:10:08.507Z"}}], "cna": {"title": "Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input", "credits": [{"lang": "en", "type": "reporter", "value": "WeitongLi (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"], "vendor": "Trusted Domain Project", "modules": ["Domain Handler"], "product": "OpenDMARC", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}]}], "timeline": [{"lang": "en", "time": "2026-09-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-27T13:38:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/410885", "name": "VDB-410885 | Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/410885/cti", "name": "VDB-410885 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-101015", "name": "CVE-2026-101015 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/917216", "name": "Submit #917216 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication", "tags": ["third-party-advisory"]}, {"url": "https://weitongli.com/share/opendmarc-unicode-dot-bypass.html", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "Improper Validation of Unsafe Equivalence in Input"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-28T08:30:08.347Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101015", "state": "PUBLISHED", "dateUpdated": "2026-10-01T14:10:12.503Z", "dateReserved": "2026-09-27T11:33:01.551Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-28T08:30:08.347Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"], "modules": ["Domain Handler"], "product": "OpenDMARC", "vendor": "Trusted Domain Project", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-101015", "lastModified": "2026-10-01T15:17:20.637", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101015", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T14:09:50.063007Z", "version": "2.0.3"}}]}, "published": "2026-09-28T09:17:05.180", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-101015"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/917216"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/410885"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/410885/cti"}, {"source": "cna@vuldb.com", "url": "https://weitongli.com/share/opendmarc-unicode-dot-bypass.html"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-1289"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "opendmarc: OpenDMARC: DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handler", "id": "2542363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542363"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-1289", "details": ["A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "A flaw was found in OpenDMARC. A remote attacker can bypass Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy checks by submitting domain names containing equivalent Unicode dot characters. Due to improper input validation in domain handling, the service fails to enforce policy restrictions properly, allowing unauthorized or spoofed emails to evade detection."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-101015", "public_date": "2026-09-28T08:30:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101015\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101015\nhttps://vuldb.com/cve/CVE-2026-101015\nhttps://vuldb.com/submit/917216\nhttps://vuldb.com/vuln/410885\nhttps://vuldb.com/vuln/410885/cti\nhttps://weitongli.com/share/opendmarc-unicode-dot-bypass.html"], "statement": "OpenDMARC is not shipped in any Red Hat product. It is available only in Fedora and EPEL community repositories.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "opendmarc", "vendor": "trusted_domain_project"}], "created": "2026-09-28T10:30:14.924289+00:00", "updated": "2026-09-28T10:30:15.256299+00:00", "vendors": ["trusted_domain_project", "trusted_domain_project$PRODUCT$opendmarc"]}