Skip to content
Critical Vulnerabilities in OpenDKIM Affect Mail Security

Critical Vulnerabilities in OpenDKIM Affect Mail Security

First seen 28 Sep 2026, 06:32 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 28, 2026 at 07:36 UTC
  • •CVE-2026-100888 and CVE-2026-100889 affect OpenDKIM up to version 2.11.0.
  • •Both vulnerabilities allow remote exploitation with public exploit code available.
  • •Internet-facing mail gateways are particularly at risk, requiring immediate action.

Two vulnerabilities, CVE-2026-100888 and CVE-2026-100889, have been identified in Trusted Domain Project OpenDKIM versions up to 2.11.0. CVE-2026-100888 involves an out-of-bounds write in the DKIM Signature Header Selection function, while CVE-2026-100889 features an off-by-one error in the Decoder component. Both vulnerabilities can be exploited remotely, and public exploit code is available. The vendor has not responded to early disclosures. Internet-facing mail gateways and organizations using DKIM signing or verification are at high risk. The potential impact includes disruption of mail flow and compromise of data integrity. Active exploitation status is uncertain due to the lack of KEV, SSVC, and EPSS data. Immediate investigation and remediation are advised.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-27
CVE-2026-100888 published
A vulnerability in OpenDKIM's DKIM Signature Header Selection function was disclosed, allowing remote exploitation.
Redpacketsecurity
2026-09-27
CVE-2026-100889 published
A vulnerability in OpenDKIM's Decoder component was disclosed, enabling remote exploitation.
Redpacketsecurity
2026-09-28
Public exploit code available
Publicly available exploit code for both vulnerabilities raises the urgency for remediation.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track CVE-2026-100888 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 4