DEBIAN-CVE-2026-100888
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-100888
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100888.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-100888
- Upstream
- CVE-2026-100888
- Published
- 2026-09-28T00:16:32Z
- Modified
- 2026-10-01T09:00:21Z
- Severity
-
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- References
Affected packages
Debian:12 / opendkim
Package
- Name
- opendkim
- Purl
- pkg:deb/debian/opendkim?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / opendkim
Package
- Name
- opendkim
- Purl
- pkg:deb/debian/opendkim?arch=source&distro=trixie
Debian:14 / opendkim
Package
- Name
- opendkim
- Purl
- pkg:deb/debian/opendkim?arch=source&distro=forky