Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-100890: OpenDMARC SPF parser can crash from remote input

CVE-2026-100890 · published 1 month ago

Summary

The OpenDMARC software (up to version 1.4.2) can mishandle specially crafted SPF data, causing the program to crash. An attacker on the network could send this data to trigger the crash, potentially disrupting email authentication services. Apply the latest security update or upgrade to a newer version of OpenDMARC to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	trusted domain project	opendmarc	1.4.0
Debian:12	debian	opendmarc	All versions
Ubuntu:Pro:16.04:LTS	canonical	opendmarc	All versions

Original advisory text

Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://weitongli.com/share/opendmarc-ip6-wild-pointer.html Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-100890 Vendor Advisory
https://vuldb.com/cve/CVE-2026-100890 Third Party Advisory
https://vuldb.com/submit/917188 Third Party Advisory
https://vuldb.com/vuln/410840 Third Party Advisory
https://vuldb.com/vuln/410840/cti Third Party Advisory
https://ubuntu.com/security/CVE-2026-100890 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-100890 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

CWE-476NULL Pointer Dereference

Timeline

Published28 Sep 2026

Updated4 Nov 2026

First seen28 Sep 2026

Sources

CVE-2026-100890 · NVD

CVE-2026-100890 · MITRE

DEBIAN-CVE-2026-100890 · OSV

UBUNTU-CVE-2026-100890 · OSV

Track software like this

Free during beta