Samba: DNS signing DoS via TKEY name cache exhaustion.
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.
AI Analysis
Technical Summary
This vulnerability in Samba's internal DNS server allows remote unauthenticated attackers to send numerous TKEY registration requests with arbitrary names that are cached before being rejected. This cache exhaustion results in eviction of legitimate TKEY entries, disrupting TSIG authentication for signed DNS queries and causing denial of service. The issue affects Red Hat Enterprise Linux 10. No official remediation level or patch information is provided in the vendor advisory.
Potential Impact
The vulnerability causes denial of service by preventing legitimate TSIG authentication for signed DNS queries due to exhaustion and eviction of TKEY cache entries. There is no impact on confidentiality or integrity reported. The CVSS score of 5.3 reflects a medium severity denial of service risk exploitable remotely without authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58218 for current remediation guidance. No official fix or workaround is stated in the provided advisory content. Until a patch is available, monitoring for unusual DNS TKEY request volumes and limiting such traffic may help mitigate impact.
Samba: DNS signing DoS via TKEY name cache exhaustion.
Description
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.
Affected software
pkg:deb/ubuntu/samba@2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/samba@2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/samba@2:4.7.6+dfsg~ubuntu-0ubuntu2.29+esm3?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/samba@2:4.15.13+dfsg-0ubuntu0.20.04.8+esm2?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/samba@2:4.15.13+dfsg-0ubuntu1.13?arch=source&distro=jammypkg:deb/ubuntu/samba@2:4.19.5+dfsg-4ubuntu9.7?arch=source&distro=noblepkg:deb/ubuntu/samba@2:4.23.6+dfsg-1ubuntu2.2?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Samba's internal DNS server allows remote unauthenticated attackers to send numerous TKEY registration requests with arbitrary names that are cached before being rejected. This cache exhaustion results in eviction of legitimate TKEY entries, disrupting TSIG authentication for signed DNS queries and causing denial of service. The issue affects Red Hat Enterprise Linux 10. No official remediation level or patch information is provided in the vendor advisory.
Potential Impact
The vulnerability causes denial of service by preventing legitimate TSIG authentication for signed DNS queries due to exhaustion and eviction of TKEY cache entries. There is no impact on confidentiality or integrity reported. The CVSS score of 5.3 reflects a medium severity denial of service risk exploitable remotely without authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58218 for current remediation guidance. No official fix or workaround is stated in the provided advisory content. Until a patch is available, monitoring for unusual DNS TKEY request volumes and limiting such traffic may help mitigate impact.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-58218
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
Threat ID: 6a6941bb9c2644c7f86af4b1
Added to database: 07/28/2026, 23:56:43 UTC
Last enriched: 07/30/2026, 14:25:25 UTC
Last updated: 09/12/2026, 10:01:32 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.