# CVE-2026-101017: Trusted Domain Project OpenDMARC exception handling in strcasecmp

Source: https://junglewise.ai/threats/cve-2026-101017-a-vulnerability-was-found-in-trusted-domain-project-opendmarc-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101017 · Severity: medium · CVSS 6.5 · Published 2026-09-28

OpenDMARC is a library that validates DMARC email authentication for mail servers. A flaw in exception handling within the strcasecmp function can be exploited remotely to cause improper handling of exceptional conditions. An attacker could trigger this vulnerability to disrupt email authentication or cause unexpected behavior in mail processing systems.

Technologies: [Trusted Domain Project OpenDMARC](https://junglewise.ai/threats/technologies/opendmarc). Vendors: [Trusted Domain Project](https://junglewise.ai/threats/vendors/trusted-domain-project).

## Quick answers

**Is CVE-2026-101017 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101017 being exploited in the wild.

**How severe is CVE-2026-101017?** Medium severity, with a CVSS score of 6.5, published 28 September 2026.

**Which products and versions are affected?** Trusted Domain Project OpenDMARC up to 1.4.2.

**Is there a fix for CVE-2026-101017?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101017 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101017?** Check whether you run Trusted Domain Project OpenDMARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the strcasecmp function within libopendmarc/opendmarc_policy.c and results in improper handling of exceptional conditions. The attack vector is network-based with no apparent authentication or user interaction required. A public exploit is available, though the vendor has not provided a fix despite early disclosure notification.

## Affected products

- Trusted Domain Project OpenDMARC up to 1.4.2

## Timeline

- 2026-09-28: disclosed
- other: Public exploit available; vendor did not respond to early disclosure notification

## References

- [https://vuldb.com/cve/CVE-2026-101017](https://vuldb.com/cve/CVE-2026-101017)
- [https://vuldb.com/submit/918247](https://vuldb.com/submit/918247)

## Related threats

- [OpenDMARC improper authentication in SPF macro handler](https://junglewise.ai/threats/cve-2026-101281-a-flaw-has-been-found-in-trusted-domain-project-opendmarc-up-to)
- [Trusted Domain Project OpenDMARC authentication bypass in Multi-Record Set Handler](https://junglewise.ai/threats/cve-2026-101280-a-vulnerability-was-detected-in-trusted-domain-project-opendmarc)
- [Trusted Domain Project OpenDMARC integer overflow in DMARC parser](https://junglewise.ai/threats/cve-2026-101279-a-security-vulnerability-has-been-detected-in-trusted-domain)
- [Trusted Domain Project OpenDMARC origin validation error in PSL Wildcard Handler](https://junglewise.ai/threats/cve-2026-101278-a-weakness-has-been-identified-in-trusted-domain-project)
- [Trusted Domain Project OpenDMARC exception handling in DMARC policy parsing](https://junglewise.ai/threats/cve-2026-101016-a-vulnerability-has-been-found-in-trusted-domain-project)