CVE-2026-58218
Awaiting Analysis Awaiting Analysis - Queue

Samba Internal DNS Server TKEY Cache Exhaustion DoS

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: redhat-SADP

Description
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-20
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-58218
EUVD
EUVD-2026-51128

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
samba samba *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-410 The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in Samba's internal DNS server where unauthenticated TKEY registration requests are added to the TKEY name cache before being rejected. An attacker can send many TKEY requests with arbitrary names to fill the cache, removing legitimate entries. This prevents valid TSIG authentication for signed DNS queries, causing a denial of service.

Detection Guidance

Monitor DNS server logs for excessive TKEY registration requests or cache evictions. Check for failed TSIG authentication attempts in DNS query logs. Use tools like tcpdump to capture and analyze DNS traffic for unusual TKEY request patterns.

Impact Analysis

If exploited, this vulnerability can disrupt DNS services by preventing legitimate authentication for signed queries. This may lead to service outages or degraded performance for DNS-dependent applications, affecting network reliability and user access to services.

Compliance Impact

This vulnerability primarily causes a denial of service by disrupting DNS query authentication, which could indirectly impact compliance with standards like GDPR or HIPAA by degrading system availability and integrity. However, the CVE does not directly link this flaw to specific compliance violations or data protection requirements.

Mitigation Strategies

Update Samba to the latest patched version. Restrict access to the DNS server port (TCP/UDP 53) to trusted networks only. Implement rate limiting for TKEY requests on the DNS server. Disable the internal DNS server if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart