CVE-2026-101015 OpenDMARC 输入验证不当漏洞
影响远程攻击者可绕过域名校验，导致邮件伪造或策略失效
OpenDMARC 1.4.2 及更早版本的 policy.c 域处理组件存在输入校验缺陷，属于不安全等价性校验不当问题。该漏洞可被远程利用，且利用代码已公开，厂商未作回应。
影响范围
Trusted Domain Project OpenDMARC 至 1.4.2 版本（含）受影响，具体受影响版本范围暂无更详细的公开信息。
漏洞详情
漏洞位于 policy.c 的域处理逻辑中，程序在比较或校验输入时未正确处理不安全等价关系，导致校验可被绕过。攻击者可远程构造特制输入触发该缺陷，从而影响 DMARC 策略判定。由于利用代码已公开，复现门槛较低。
利用条件与风险
攻击者可远程发起利用，无需本地访问；结合已公开的利用代码，实战中被用于绕过邮件域验证、实施伪造邮件的风险较高。
修复建议
厂商未对该披露作出回应，暂无官方补丁信息；建议关注 Trusted Domain Project 官方更新，或在邮件网关侧加强 DMARC 校验与异常输入过滤作为临时缓解。
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.