CVE-2024-58259
Fixed in a distro release EPSS <1%CVSS 8.2
A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).
Products: SUSE Rancher
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.12.1 |
| Go | github.com/rancher/rancher | 2.11.5 |
| Go | github.com/rancher/rancher | 2.10.9 |
| Go | github.com/rancher/rancher | 2.9.11 |
| Go | github.com/rancher/rancher | 0.0.0-20250813072957-aee95d4e2a41 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250908T141310-1.1 |