A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of…

cve CVE-2026-100889 2 sources, 2 claims · Watch

NVD writes:
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. the claim

Severity they disagree: medium GitHub advisories
HIGH NVD
CVSS: 7.3 GitHub advisories
7.3 NVD
Vendor: Trusted Domain Project NVD
Product: OpenDKIM NVD
CWE: CWE-189, CWE-193 NVD

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Timeline

2026-09-28	first spoke of it: A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the...	GitHub advisories
2026-09-28	first spoke of it: A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	NVD

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

What it is to other things

In words only, so not counted until a person confirms one:

affects	`trusted_domain_project/opendkim` NVD says “Trusted Domain Project · OpenDKIM”
made_by	`trusted_domain_project` NVD says “Trusted Domain Project”

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

yes

An attacker can reliably run all of the kill chain's first four steps without a person.

receipt

Source: NVD
Its words: yes
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	yes
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

GitHub advisories

7.3

receipt

Source: GitHub advisories
Its words: 7.3
Read by: field:cvss.score
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100889",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [],
  "description": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.003,
    "percentile": 0.20331
  },
  "ghsa_id": "GHSA-87hw-mmxf-r6m3",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-87hw-mmxf-r6m3",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-87hw-mmxf-r6m3"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100889"
    }
  ],
  "nvd_published_at": "2026-09-28T00:16:32Z",
  "published_at": "2026-09-28T00:30:28Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100889",
    "https://vuldb.com/cve/CVE-2026-100889",
    "https://vuldb.com/submit/917063",
    "https://vuldb.com/vuln/410839",
    "https://vuldb.com/vuln/410839/cti",
    "https://weitongli.com/share/opendkim-qp-off-by-one.html",
    "https://github.com/advisories/GHSA-87hw-mmxf-r6m3"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T00:30:36Z",
  "url": "https://api.github.com/advisories/GHSA-87hw-mmxf-r6m3",
  "vulnerabilities": [],
  "withdrawn_at": null
}

—

CVSS

cvss

NVD

7.3

receipt

Source: NVD
Its words: 7.3
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:39 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Cvss4

cvss4

NVD

5.5

receipt

Source: NVD
Its words: 5.5
Read by: field:cve.metrics.cvssMetricV40[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV40[].cvssData.baseScore
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	5.5
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Cvss4 vector

cvss4_vector

NVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

receipt

Source: NVD
Its words: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Read by: field:cve.metrics.cvssMetricV40[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV40[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

NVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

NVD

CWE-189, CWE-193

receipt

Source: NVD
Its words: CWE-189, CWE-193
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CWE-189, CWE-193
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Exploitation

exploitation

NVD

poc

A public proof of concept exists, or exploitation is trivial.

receipt

Source: NVD
Its words: poc
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	poc
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Product

product

NVD

OpenDKIM

receipt

Source: NVD
Its words: OpenDKIM
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	OpenDKIM
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

conflict

GitHub advisories

medium

receipt

Source: GitHub advisories
Its words: medium
Read by: field:severity
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-100889",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [],
  "description": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "epss": {
    "percentage": 0.003,
    "percentile": 0.20331
  },
  "ghsa_id": "GHSA-87hw-mmxf-r6m3",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-87hw-mmxf-r6m3",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-87hw-mmxf-r6m3"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-100889"
    }
  ],
  "nvd_published_at": "2026-09-28T00:16:32Z",
  "published_at": "2026-09-28T00:30:28Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-100889",
    "https://vuldb.com/cve/CVE-2026-100889",
    "https://vuldb.com/submit/917063",
    "https://vuldb.com/vuln/410839",
    "https://vuldb.com/vuln/410839/cti",
    "https://weitongli.com/share/opendkim-qp-off-by-one.html",
    "https://github.com/advisories/GHSA-87hw-mmxf-r6m3"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T00:30:36Z",
  "url": "https://api.github.com/advisories/GHSA-87hw-mmxf-r6m3",
  "vulnerabilities": [],
  "withdrawn_at": null
}

—

Severity

severity

conflict

NVD

HIGH

From 7.0 to 8.9.

receipt

Source: NVD
Its words: HIGH
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	HIGH
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

high

Status

status

NVD

Deferred

receipt

Source: NVD
Its words: Deferred
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:39 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	partial
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Trusted Domain Project

receipt

Source: NVD
Its words: Trusted Domain Project
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Trusted Domain Project
2026-09-29 09:39 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:a:trusted_domain_project:opendkim:*:*:*:*:*:*:*:*"
            ],
            "modules": [
              "Decoder"
            ],
            "product": "OpenDKIM",
            "vendor": "Trusted Domain Project",
            "versions": [
              {
                "status": "affected",
                "version": "2.0"
              },
              {
                "status": "affected",
                "version": "2.1"
              },
              {
                "status": "affected",
                "version": "2.2"
              },
              {
                "status": "affected",
                "version": "2.3"
              },
              {
                "status": "affected",
                "version": "2.4"
              },
              {
                "status": "affected",
                "version": "2.5"
              },
              {
                "status": "affected",
                "version": "2.6"
              },
              {
                "status": "affected",
                "version": "2.7"
              },
              {
                "status": "affected",
                "version": "2.8"
              },
              {
                "status": "affected",
                "version": "2.9"
              },
              {
                "status": "affected",
                "version": "2.10"
              },
              {
                "status": "affected",
                "version": "2.11.0"
              }
            ]
          }
        ],
        "source": "cna@vuldb.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
      }
    ],
    "id": "CVE-2026-100889",
    "lastModified": "2026-09-28T15:16:04.793",
    "metrics": {
      "cvssMetricV2": [
        {
          "acInsufInfo": false,
          "baseSeverity": "HIGH",
          "cvssData": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "source": "cna@vuldb.com",
          "type": "Secondary",
          "userInteractionRequired": false
        }
      ],
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.4,
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cna@vuldb.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-100889",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-28T13:06:30.451887Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-28T00:16:32.647",
    "references": [
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/cve/CVE-2026-100889"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/submit/917063"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://vuldb.com/vuln/410839/cti"
      },
      {
        "source": "cna@vuldb.com",
        "url": "https://weitongli.com/share/opendkim-qp-off-by-one.html"
      }
    ],
    "sourceIdentifier": "cna@vuldb.com",
    "vulnStatus": "Deferred",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-189"
          },
          {
            "lang": "en",
            "value": "CWE-193"
          }
        ],
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. zetlyn/cve-nvd · 2026-09-28	automatable yes cvss 7.3 cvss4 5.5 cvss4_vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L cwe CWE-189, CWE-193 exploitation poc product OpenDKIM severity HIGH status Deferred technical_impact partial vendor Trusted Domain Project	source
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the... zetlyn/cve-ghsa · 2026-09-28	cvss 7.3 severity medium	source