CVE-2026-101277: Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are in scope?
Trusted Domain Project OpenDKIM versions up to and including 2.11.0 are identified as affected. The issue is in the Tag Tokenizer component, specifically the dkim_process_set function in dkim.c.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges, and no user interaction are required.
What is the practical impact of successful exploitation?
The reported impact is use of a less trusted source, with integrity and availability rated as low impact. Confidentiality impact is rated as none.
Is public exploit information available?
Yes. The exploit has been released publicly and may be used in attacks.
What can be done if patching is not immediately possible?
The provided data does not identify a workaround or mitigation. Prioritize limiting remote exposure of affected OpenDKIM instances and monitor for vendor guidance.