Skip to main content

Samba DNS Server CVE-2026-58218

| EUVDEUVD-2026-51128 MEDIUM
Insufficient Resource Pool (CWE-410)
2026-07-30 redhat GHSA-qcxx-8h4x-9v7w
Denial Of Service Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Suse Red Hat
5.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-reachable DNS port, no authentication or complexity required; impact is limited availability loss (TSIG cache only), with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 14:58 vuln.today
CVE Published
Jul 30, 2026 - 14:01 nvd
MEDIUM 5.3

DescriptionCVE.org

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

AnalysisAI

Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.

Technical ContextAI

TKEY (Transaction KEY) is a DNS record type defined in RFC 2930 used for establishing shared secret keys to enable TSIG (Transaction SIGnature) authentication of DNS messages. Samba's internal DNS server - used when Samba operates as an Active Directory Domain Controller with its built-in DNS backend rather than BIND - maintains a name cache of TKEY entries to facilitate TSIG session setup. CWE-410 (Insufficient Resource Pool) is the root cause: the server adds incoming TKEY request names to this bounded cache prior to performing validation or authorization, meaning even requests destined for rejection consume cache slots. A finite cache filled with attacker-controlled garbage entries displaces legitimate TKEY state needed by authorized clients. Affected CPE strings confirm impact across Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, indicating broad distribution-level exposure to the underlying Samba package.

RemediationAI

Apply the vendor-released patch from Samba upstream (https://www.samba.org/samba/security/CVE-2026-58218.html) or via your Linux distribution's package manager - Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58218, Ubuntu at https://ubuntu.com/security/notices/USN-8621-1. Exact patched Samba version numbers were not specified in the input data and should be confirmed against those advisories before deployment. As a compensating control, administrators can restrict inbound DNS TKEY requests at the perimeter firewall or DNS load balancer to trusted source IP ranges, since TSIG key negotiation should only originate from known domain-joined clients and DNS secondaries; this trades some operational flexibility for reduced attack surface. Alternatively, deploying an external DNS server such as BIND as the AD DNS backend rather than Samba's internal DNS eliminates the vulnerable code path entirely, though this requires AD DNS re-delegation and operational overhead.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-410 – Insufficient Resource Pool

View all
CVE-2025-27479 HIGH
7.5
CVE-2025-0453 HIGH POC
7.5
CVE-2023-38505 HIGH POC
7.5
CVE-2021-1615 HIGH
8.6
CVE-2022-2048 HIGH
7.5
CVE-2019-13921 HIGH
7.5
CVE-2019-0056 HIGH
7.5
CVE-2018-13815 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/samba-client:latest Container suse/samba-toolbox:latest Affected
Container suse/samba-server:latest Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP7-BYOS-EC2 Affected
SUSE Enterprise Storage 7.1 Fixed

Share

CVE-2026-58218 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy