CVE-2026-101281
Description
A flaw was found in OpenDMARC. The Sender Policy Framework (SPF) macro handling logic improperly validates the sender domain during message processing. A remote attacker can exploit this vulnerability by sending specially crafted email messages, potentially bypassing email authentication checks.
Statement
This vulnerability is rated as Important because unauthenticated remote attackers can forge sender identities and bypass DMARC verification policies without requiring user interaction. OpenDMARC is not included in supported Red Hat Enterprise Linux releases, being provided solely through Fedora and Extra Packages for Enterprise Linux (EPEL) community repositories. Systems that do not deploy OpenDMARC as an email filtering milter remain unaffected.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
