Vulnerability · Published Sep 2, 2025 · Assigned by suse
CVE-2024-58259Rancher affected by unauthenticated Denial of Service
High 8.2
In plain English
A high-severity resource allocation without limits in rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.12.1 | GHSA-4h45-jpvh-6p5j |
| Go | github.com/rancher/rancher | 2.11.5 | GHSA-4h45-jpvh-6p5j |
| Go | github.com/rancher/rancher | 2.10.9 | GHSA-4h45-jpvh-6p5j |
| Go | github.com/rancher/rancher | 2.9.11 | GHSA-4h45-jpvh-6p5j |
| Go | github.com/rancher/rancher | 0.0.0-20250813072957-aee95d4e2a41 | GHSA-4h45-jpvh-6p5j |
| Go | github.com/rancher/rancher | 0.0.0-20250813072957-aee95d4e2a41 | GO-2025-3923 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H