CVE-2024-58259

Rancher affected by unauthenticated Denial of Service

State: Published
Severity: 8.2 High
Published: Sep 2, 2025
Updated: Sep 2, 2025
Reserved: Jul 23, 2025

Description

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	suse

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
rancherSUSE	2.12.0 to before 2.12.1Affected 2.11.0 to before 2.11.5Affected 2.10.0 to before 2.10.9Affected 2.9.0 to before 2.9.11Affected before 0.0.0-20250813072957-aee95d4e2a41Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.