DEBIAN-CVE-2026-58224

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-58224

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58224.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-58224

Upstream

CVE-2026-58224

Published

2026-08-14T15:17:09Z

Modified

2026-09-01T16:06:52Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

References

https://security-tracker.debian.org/tracker/CVE-2026-58224

Affected packages

Debian:12 / samba

Package

Name: samba
Purl: pkg:deb/debian/samba?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2:4.*

2:4.17.8+dfsg-2

2:4.17.8+dfsg-2.1

2:4.17.9+dfsg-0+deb12u1

2:4.17.9+dfsg-0+deb12u2

2:4.17.9+dfsg-0+deb12u3~bpo11+1

2:4.17.9+dfsg-0+deb12u3

2:4.17.10+dfsg-0+deb12u1~bpo11+1

2:4.17.10+dfsg-0+deb12u1

2:4.17.11+dfsg-0+deb12u1

2:4.17.12+dfsg-0+deb12u1~bpo11+1

2:4.17.12+dfsg-0+deb12u1

2:4.17.12+dfsg-0+deb12u2

2:4.17.12+dfsg-0+deb12u3

2:4.17.12+dfsg-0+deb12u4

2:4.18.0~rc1+dfsg-1exp

2:4.18.0~rc2+dfsg-1

2:4.18.0~rc3+dfsg-1

2:4.18.0~rc4+dfsg-1

2:4.18.0+dfsg-1~exp1

2:4.18.1+dfsg-1~exp1

2:4.18.2+dfsg-1

2:4.18.3+dfsg-1

2:4.18.3+dfsg-2

2:4.18.3+dfsg-3

2:4.18.4+dfsg-1

2:4.18.4+dfsg-2~bpo12+1

2:4.18.4+dfsg-2

2:4.18.5+dfsg-1

2:4.18.5+dfsg-2~bpo12+1

2:4.18.5+dfsg-2

2:4.18.6+dfsg-1~bpo12+1

2:4.18.6+dfsg-1

2:4.18.8+dfsg-1~bpo12+1

2:4.19.0~rc1+dfsg-1

2:4.19.0~rc1+dfsg-2

2:4.19.0~rc1+dfsg-3

2:4.19.0~rc2+dfsg-1

2:4.19.0~rc4+dfsg-1

2:4.19.0~rc4+dfsg-2

2:4.19.0+dfsg-1

2:4.19.1+dfsg-1

2:4.19.1+dfsg-2

2:4.19.1+dfsg-3

2:4.19.1+dfsg-4

2:4.19.2+dfsg-1

2:4.19.3+dfsg-1~bpo12+1

2:4.19.3+dfsg-1

2:4.19.3+dfsg-2

2:4.19.4+dfsg-1

2:4.19.4+dfsg-2~bpo12+1

2:4.19.4+dfsg-2

2:4.19.4+dfsg-3~bpo12+1

2:4.19.4+dfsg-3

2:4.19.5+dfsg-1

2:4.19.5+dfsg-2

2:4.19.5+dfsg-3

2:4.19.5+dfsg-4~bpo12+1

2:4.19.5+dfsg-4

2:4.19.5+dfsg-5

2:4.19.6+dfsg-1

2:4.19.6+dfsg-2

2:4.19.6+dfsg-3~bpo12+1

2:4.19.6+dfsg-3

2:4.20.0~rc1+dfsg-1

2:4.20.0~rc2+dfsg-1

2:4.20.0~rc2+dfsg-2

2:4.20.0~rc2+dfsg-3

2:4.20.0+dfsg-1~exp1

2:4.20.0+dfsg-1~exp2

2:4.20.1+dfsg-1

2:4.20.1+dfsg-2

2:4.20.1+dfsg-3

2:4.20.1+dfsg-4~bpo12+1

2:4.20.1+dfsg-4

2:4.20.1+dfsg-5

2:4.20.2+dfsg-1

2:4.20.2+dfsg-2~bpo12+1

2:4.20.2+dfsg-2~bpo12+2

2:4.20.2+dfsg-2

2:4.20.2+dfsg-3

2:4.20.2+dfsg-4

2:4.20.2+dfsg-5~bpo12+1

2:4.20.2+dfsg-5

2:4.20.2+dfsg-6~bpo12+1

2:4.20.2+dfsg-6

2:4.20.2+dfsg-7

2:4.20.2+dfsg-8

2:4.20.2+dfsg-9~exp1

2:4.20.2+dfsg-9~exp2

2:4.20.2+dfsg-9

2:4.20.2+dfsg-10

2:4.20.4+dfsg-1~bpo12+1

2:4.20.5+dfsg-1~bpo12+1

2:4.21.0~rc1+dfsg-1

2:4.21.0~rc1+really4.20.2+dfsg-11

2:4.21.0~rc1+really4.20.2+dfsg-11r

2:4.21.0~rc1+really4.20.3+dfsg-1

2:4.21.0~rc1+really4.20.4+dfsg-1

2:4.21.0~rc2+dfsg-1

2:4.21.0+dfsg-1

2:4.21.1+dfsg-1~bpo12+1

2:4.21.1+dfsg-1

2:4.21.1+dfsg-2~bpo12+1

2:4.21.1+dfsg-2

2:4.21.1+dfsg-2+hurd.1

2:4.21.2+dfsg-1

2:4.21.2+dfsg-2

2:4.21.2+dfsg-3~bpo12+1

2:4.21.2+dfsg-3

2:4.21.2+dfsg-4~exp1

2:4.21.2+dfsg-4

2:4.21.2+dfsg-4+hurd.1

2:4.21.3+dfsg-1~bpo12+1

2:4.21.3+dfsg-1

2:4.21.3+dfsg-2

2:4.21.3+dfsg-3

2:4.21.3+dfsg-4~bpo12+1

2:4.21.3+dfsg-4

2:4.21.3+dfsg-5~bpo12+1

2:4.21.3+dfsg-5

2:4.21.3+dfsg-6~bpo12+1

2:4.21.3+dfsg-6

2:4.21.4+dfsg-1~bpo12+1

2:4.21.4+dfsg-1

2:4.21.5+dfsg-1~bpo12+1

2:4.22.0~rc1+dfsg-1

2:4.22.0+dfsg-1

2:4.22.0+dfsg-2

2:4.22.0+dfsg-3

2:4.22.1+dfsg-1~bpo12+1

2:4.22.1+dfsg-1

2:4.22.2+dfsg-1~bpo12+1

2:4.22.2+dfsg-1

2:4.22.3+dfsg-1

2:4.22.3+dfsg-2~bpo12+1

2:4.22.3+dfsg-2

2:4.22.3+dfsg-3

2:4.22.3+dfsg-4~bpo12+1

2:4.22.3+dfsg-4

2:4.22.4+dfsg-1~deb13u1~bpo12+1

2:4.22.4+dfsg-1~deb13u1

2:4.22.4+dfsg-1

2:4.23.0~rc1+dfsg-1

2:4.23.0~rc2+dfsg-1

2:4.23.0~rc3+dfsg-1

2:4.23.0+dfsg-1

2:4.23.0+dfsg-2

2:4.23.0+dfsg-3

2:4.23.1+dfsg-1

2:4.23.2+dfsg-1

2:4.23.3+dfsg-1~bpo13+1

2:4.23.3+dfsg-1

2:4.23.4+dfsg-1~bpo13+1

2:4.23.4+dfsg-1

2:4.23.5+dfsg-1~bpo13+1

2:4.23.5+dfsg-1

2:4.23.6+dfsg-1

2:4.23.6+dfsg-2~bpo13+1

2:4.23.6+dfsg-2

2:4.24.0~rc1+dfsg-1

2:4.24.0~rc1+dfsg-2

2:4.24.0~rc1+dfsg-3

2:4.24.0~rc2+dfsg-1

2:4.24.0+dfsg-1

2:4.24.1+dfsg-1

2:4.24.2+dfsg-1~bpo13+1

2:4.24.2+dfsg-1

2:4.24.3+dfsg-1~bpo13+1

2:4.24.3+dfsg-1

2:4.24.4+dfsg-1~bpo13+1

2:4.24.4+dfsg-1

2:4.24.5+dfsg-1~bpo13+1

2:4.24.5+dfsg-1

2:4.24.6+dfsg-1

2:4.25.0~rc1+dfsg-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58224.json"

Debian:13 / samba

Package

Name: samba
Purl: pkg:deb/debian/samba?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2:4.22.10+dfsg-0+deb13u2

Affected versions

2:4.*

2:4.22.3+dfsg-4

2:4.22.4+dfsg-1~deb13u1~bpo12+1

2:4.22.4+dfsg-1~deb13u1

2:4.22.4+dfsg-1

2:4.22.6+dfsg-0+deb13u1~bpo12+1

2:4.22.6+dfsg-0+deb13u1

2:4.22.8+dfsg-0+deb13u1

2:4.22.8+dfsg-0+deb13u2

2:4.22.10+dfsg-0+deb13u1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58224.json"

Debian:14 / samba

Package

Name: samba
Purl: pkg:deb/debian/samba?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2:4.24.5+dfsg-1

Affected versions

2:4.*

2:4.22.3+dfsg-4

2:4.22.4+dfsg-1~deb13u1~bpo12+1

2:4.22.4+dfsg-1~deb13u1

2:4.22.4+dfsg-1

2:4.23.0~rc1+dfsg-1

2:4.23.0~rc2+dfsg-1

2:4.23.0~rc3+dfsg-1

2:4.23.0+dfsg-1

2:4.23.0+dfsg-2

2:4.23.0+dfsg-3

2:4.23.1+dfsg-1

2:4.23.2+dfsg-1

2:4.23.3+dfsg-1~bpo13+1

2:4.23.3+dfsg-1

2:4.23.4+dfsg-1~bpo13+1

2:4.23.4+dfsg-1

2:4.23.5+dfsg-1~bpo13+1

2:4.23.5+dfsg-1

2:4.23.6+dfsg-1

2:4.23.6+dfsg-2~bpo13+1

2:4.23.6+dfsg-2

2:4.24.0~rc1+dfsg-1

2:4.24.0~rc1+dfsg-2

2:4.24.0~rc1+dfsg-3

2:4.24.0~rc2+dfsg-1

2:4.24.0+dfsg-1

2:4.24.1+dfsg-1

2:4.24.2+dfsg-1~bpo13+1

2:4.24.2+dfsg-1

2:4.24.3+dfsg-1~bpo13+1

2:4.24.3+dfsg-1

2:4.24.4+dfsg-1~bpo13+1

2:4.24.4+dfsg-1

2:4.24.5+dfsg-1~bpo13+1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-58224.json"