CVE-2026-58218.html:

===========================================================
== Subject:     DNS signing DoS via TKEY name cache exhaustion
==
== CVE ID#:     CVE-2025-58218
==
== Versions:    All versions since 4.0
==

== Summary:     An unauthenticated user can repeatedly register names
                TKEY names, which floods a cache causing legitimate
		TKEYs to be expunged. This can practically block the use
		DNS TSIG signing.

===========================================================

===========
Description
===========

Only authenticated users are supposed to be able to use TKEY DNS
records to register shared secrets for use with TSIG queries. Samba
has been rejecting unauthenticated queries, but only after registering
the TKEY names in a cache used to filter out TSIG requests.

By flooding the DNS server with TKEY requests with arbitrary names,
an attacker can block legitimate TSIG use. 

This bug exacerbates CVE-2026-6949 (crafted TSIG packet can crash the
DNS server) because it means the attacker there does not need to be
authenticated.

==================
Patch Availability
==================

Patches addressing this issue have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba $VERSIONS have been issued
as security releases to correct the defect.  Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3)

==========
Workaround
==========

The BIND9 DLZ is not affected.

=======
Credits
=======

Originally reported by Andrew Tridgell of the Samba Team.

Also reported by Tristan Madani of Talence Security.

Patches provided by Volker Lendecke of the Samba team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================