Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-101277 EUVD-2026-88584GHSA-frgp-cm59-pw23

Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source

Published Sep 28, 2026 · Updated Sep 29, 2026 · Assigned by VulDB

Description

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

VendorProductAffectedFixed
Trusted Domain Project OpenDKIM 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 opendkim No fix yet —
Debian 13 opendkim No fix yet —
Debian 12 opendkim No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 opendkim No fix yet —
Ubuntu 26.04 LTS opendkim No fix yet —
Ubuntu 24.04 LTS opendkim No fix yet —
Ubuntu 22.04 LTS opendkim No fix yet —
Ubuntu 20.04 LTS opendkim No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS opendkim No fix yet —
Ubuntu 16.04 LTS opendkim No fix yet —

References