CVE-2026-100889 Trusted Domain Project CVE debrief

Who should care

Defenders responsible for OpenDKIM installations up to 2.11.0 should assess exposure and prioritize verification. This includes operators, security teams, and vulnerability management teams who need to verify OpenDKIM versions up to 2.11.0 and assess exposure to the vulnerable function dkim_qp_decode. Defenders should also monitor for potential remote attacks and review compensating controls for exposed systems.

Why it matters

Defenders should prioritize verification of OpenDKIM versions up to 2.11.0 and assess exposure in their environments due to the publicly available exploit.

• Verify OpenDKIM versions up to 2.11.0 for potential vulnerability
• Assess exposure to remote attacks
• Monitor for potential exploitation

Technical summary

The vulnerability is caused by an off-by-one error in the dkim_qp_decode function of the util.c file in OpenDKIM up to 2.11.0. The attack may be performed from remote. The exploit is now public and may be used. This vulnerability affects OpenDKIM installations up to 2.11.0 and defenders should prioritize verification of these versions and assess exposure in their environments. The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact.

Defensive priority

Defenders should prioritize verification of OpenDKIM versions up to 2.11.0 and assess exposure in their environments.

Recommended defensive actions

• Verify OpenDKIM versions up to 2.11.0 in your environment
• Assess exposure to the vulnerable function dkim_qp_decode
• Monitor for potential remote attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions and potential impact. The vulnerability is caused by an off-by-one error in the dkim_qp_decode function of the util.c file in OpenDKIM up to 2.11.0. The attack may be performed from remote. The exploit is now public and may be used.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.