Opendmarc
Monthly
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by exploiting a misordered domain-setting sequence in the SPF Macro Handler, causing SPF-backed DMARC checks to evaluate the attacker-controlled HELO domain instead of the envelope MAIL FROM domain. Publicly available exploit code exists, though successful exploitation depends on the libspf2 version (some versions treat the first-set domain as the SPF check domain). This is a low-to-medium severity email-authentication flaw with no confidentiality or availability impact, only limited integrity impact.
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC anti-spoofing check by supplying a multi-record DMARC TXT set that the Multi-Record Set Handler evaluates more permissively than RFC 7489 requires. The affected mail server must run OpenDMARC as its DMARC verifier and the attacker must control or influence DNS for the spoofed sender domain; no credentials or user interaction are required (PR:N/UI:N), though the resulting impact is limited to forged mail passing DMARC rather than host compromise. Publicly available exploit code exists, the vendor was contacted early and did not respond, and no vendor-released patch was identified at time of analysis.
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage handling by supplying a crafted 'pct=' value in a DMARC DNS TXT record. Publicly available exploit code exists, but the vulnerability is not confirmed actively exploited (CISA KEV). Exploitation requires the target to be actively performing DMARC verification on inbound mail and the attacker to control a queried domain's DMARC record; assessed impact is limited to integrity of policy-percentage handling and minor availability disruption, not RCE or data disclosure.
Origin validation error in OpenDMARC through version 1.4.2 lets remote attackers trigger incorrect organizational-domain extraction by sending mail from a specially crafted domain, potentially undermining DMARC alignment and allowing spoofed messages to evade DMARC-based filtering. The flaw carries a CVSS 4.0 base score of 5.3 and affects integrity only; publicly available exploit code exists, but there is no confirmation of active exploitation, and the vendor did not respond to disclosure so no official patch is available.
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records trigger improper handling of exceptional conditions in OpenDMARC 1.4.2 and earlier (opendmarc_policy_parse_dmarc), letting remote unauthenticated senders disrupt or weaken DMARC enforcement on mail servers that run OpenDMARC as a Postfix or Sendmail milter. Impact is confined to availability (milter crash/denial of processing) and integrity (misapplied or weakened policy), not code execution or data theft. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch is identified at time of analysis; the independent assessment characterizes this as a genuine but modest DMARC-integrity issue rather than a high-severity emergency.
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domain identifiers that use Unicode full-stop equivalents (such as U+3002 or U+FF0E), which the Domain Handler in policy.c treats as equivalent to the ASCII dot when it should not. Because the flaw sits in the default inbound-milter use case, any MTA running OpenDMARC <=1.4.2 (typically via Postfix or Sendmail) that relies on OpenDMARC verdicts for spoofing decisions is exposed; remote, unauthenticated attackers can send specially crafted mail with no user interaction required. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and given the independent assessment the practical impact is limited to DMARC bypass/spoofing effectiveness rather than code execution, data access, or service disruption.
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a crafted message that causes the DMARC record parser's opendmarc_util_cleanup routine to write one byte past the end of a buffer; publicly available exploit code exists. The practical impact is narrow - the overflow is a single NUL byte, so the realistic outcome is a crash or denial of service rather than controllable memory corruption, which aligns with the independently assessed CVSS:3.1 vector (C:N/I:L/A:L). The flaw requires the target to run an affected OpenDMARC milter on an internet-facing mail server and to process attacker-influenced input whose length exactly equals the destination buffer size, so triggering is constrained.
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_policy_query_dmarc, allowing a remote, unauthenticated attacker to trigger an encoding error with a crafted email and potentially distort DMARC evaluation on internet-facing mail servers that run OpenDMARC as a milter/library, typically with Postfix or Sendmail. Publicly available exploit code exists, but the supplied data does not confirm active exploitation or a CISA KEV entry. The independent assessment rates this as a moderate integrity and availability issue rather than a high-urgency compromise: CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, because the flaw requires an IDN/non-ASCII domain edge case and the practical payoff depends on downstream trust in the DMARC verdict.
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filter when it processes certain SPF data for an inbound message. The flaw sits in opendmarc_spf_ipv6_explode() in libopendmarc/opendmarc_spf.c, where manipulation of the `cp` argument causes the parser to dereference a NULL pointer; it is remotely reachable by an unauthenticated attacker (CVSS 4.0 6.9, CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) who can influence the SPF information evaluated during mail handling. Publicly available exploit code exists and the vendor did not respond to the disclosure, but there is no confirmed active exploitation (not listed in CISA KEV). Impact is limited to availability of the filter process rather than host compromise; the referenced proof-of-concept is published at weitongli.com.
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by exploiting a misordered domain-setting sequence in the SPF Macro Handler, causing SPF-backed DMARC checks to evaluate the attacker-controlled HELO domain instead of the envelope MAIL FROM domain. Publicly available exploit code exists, though successful exploitation depends on the libspf2 version (some versions treat the first-set domain as the SPF check domain). This is a low-to-medium severity email-authentication flaw with no confidentiality or availability impact, only limited integrity impact.
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC anti-spoofing check by supplying a multi-record DMARC TXT set that the Multi-Record Set Handler evaluates more permissively than RFC 7489 requires. The affected mail server must run OpenDMARC as its DMARC verifier and the attacker must control or influence DNS for the spoofed sender domain; no credentials or user interaction are required (PR:N/UI:N), though the resulting impact is limited to forged mail passing DMARC rather than host compromise. Publicly available exploit code exists, the vendor was contacted early and did not respond, and no vendor-released patch was identified at time of analysis.
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage handling by supplying a crafted 'pct=' value in a DMARC DNS TXT record. Publicly available exploit code exists, but the vulnerability is not confirmed actively exploited (CISA KEV). Exploitation requires the target to be actively performing DMARC verification on inbound mail and the attacker to control a queried domain's DMARC record; assessed impact is limited to integrity of policy-percentage handling and minor availability disruption, not RCE or data disclosure.
Origin validation error in OpenDMARC through version 1.4.2 lets remote attackers trigger incorrect organizational-domain extraction by sending mail from a specially crafted domain, potentially undermining DMARC alignment and allowing spoofed messages to evade DMARC-based filtering. The flaw carries a CVSS 4.0 base score of 5.3 and affects integrity only; publicly available exploit code exists, but there is no confirmation of active exploitation, and the vendor did not respond to disclosure so no official patch is available.
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records trigger improper handling of exceptional conditions in OpenDMARC 1.4.2 and earlier (opendmarc_policy_parse_dmarc), letting remote unauthenticated senders disrupt or weaken DMARC enforcement on mail servers that run OpenDMARC as a Postfix or Sendmail milter. Impact is confined to availability (milter crash/denial of processing) and integrity (misapplied or weakened policy), not code execution or data theft. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch is identified at time of analysis; the independent assessment characterizes this as a genuine but modest DMARC-integrity issue rather than a high-severity emergency.
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domain identifiers that use Unicode full-stop equivalents (such as U+3002 or U+FF0E), which the Domain Handler in policy.c treats as equivalent to the ASCII dot when it should not. Because the flaw sits in the default inbound-milter use case, any MTA running OpenDMARC <=1.4.2 (typically via Postfix or Sendmail) that relies on OpenDMARC verdicts for spoofing decisions is exposed; remote, unauthenticated attackers can send specially crafted mail with no user interaction required. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and given the independent assessment the practical impact is limited to DMARC bypass/spoofing effectiveness rather than code execution, data access, or service disruption.
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a crafted message that causes the DMARC record parser's opendmarc_util_cleanup routine to write one byte past the end of a buffer; publicly available exploit code exists. The practical impact is narrow - the overflow is a single NUL byte, so the realistic outcome is a crash or denial of service rather than controllable memory corruption, which aligns with the independently assessed CVSS:3.1 vector (C:N/I:L/A:L). The flaw requires the target to run an affected OpenDMARC milter on an internet-facing mail server and to process attacker-influenced input whose length exactly equals the destination buffer size, so triggering is constrained.
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_policy_query_dmarc, allowing a remote, unauthenticated attacker to trigger an encoding error with a crafted email and potentially distort DMARC evaluation on internet-facing mail servers that run OpenDMARC as a milter/library, typically with Postfix or Sendmail. Publicly available exploit code exists, but the supplied data does not confirm active exploitation or a CISA KEV entry. The independent assessment rates this as a moderate integrity and availability issue rather than a high-urgency compromise: CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, because the flaw requires an IDN/non-ASCII domain edge case and the practical payoff depends on downstream trust in the DMARC verdict.
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filter when it processes certain SPF data for an inbound message. The flaw sits in opendmarc_spf_ipv6_explode() in libopendmarc/opendmarc_spf.c, where manipulation of the `cp` argument causes the parser to dereference a NULL pointer; it is remotely reachable by an unauthenticated attacker (CVSS 4.0 6.9, CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) who can influence the SPF information evaluated during mail handling. Publicly available exploit code exists and the vendor did not respond to the disclosure, but there is no confirmed active exploitation (not listed in CISA KEV). Impact is limited to availability of the filter process rather than host compromise; the referenced proof-of-concept is published at weitongli.com.
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.