CVE-2026-58218

MediumCVSS 5.3/10Last modified Jul 30, 2026

Description

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-410

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Jul 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-582228.8A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD CVE-2026-582246.5A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol CVE-2026-582252.1SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconn CVE-2026-582268.7Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer de CVE-2026-582277.5The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshak CVE-2026-582285.1Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute Java CVE-2026-582298.2Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host an CVE-2026-58236.3A weakness has been identified in itsourcecode Construction Management System 1.0. Affected by this issue is some unknown functionality of t CVE-2026-582307.0SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a s CVE-2026-5823110.0SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain CVE-2026-582337.6SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, w CVE-2026-582342.2SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitio