Most recent entries from all

EUVD-2026-251568

2026-10-03T16:38:53.658409+00:00

EUVD-2026-251568

fkie_cve-2024-58259

2026-10-03T16:38:53.658474+00:00

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

GHSA-4h45-jpvh-6p5j — Rancher affected by unauthenticated Denial of Service

2026-10-03T16:38:53.658538+00:00

Affected: Go: github.com/rancher/rancher

### Impact A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing. This could result in: - Denial of Service (DoS): The server process may crash or become unresponsive when memory consumption exceeds available resources. - Unauthenticated and authenticated exploitation: While the issue was initially observed in unauthenticated `/v3-public/*` endpoints, the absence of request body size limits also affected several authenticated APIs, broadening the potential attack surface. It's worth noting that other areas in Rancher do implement safeguards: requests proxied to Kubernetes APIs are subject to built-in size limits enforced by the [Kubernetes API server itself](https://github.com/kubernetes/kubernetes/blob/v1.33.4/staging/src/k8s.io/apiserver/pkg/server/config.go#L465), and Norman-based endpoints parse input with [predefined size caps](https://github.com/rancher/norman/blob/41dfae2f1a640c5ac9304e8b51e45a0f52cbdbb9/parse/read_input.go#L20-L31). However, the absence of similar protections in other Rancher APIs increased the risk of denial-of-service (DoS) scenarios in certain contexts.

By sending large binary or text payloads to vulnerable endpoints, a malicious actor could disrupt Rancher’s availability, impacting both…

openSUSE-SU-2025:15538-1 — govulncheck-vulndb-0.0.20250908T141310-1.1 on GA media

2026-10-03T16:38:53.658653+00:00

govulncheck-vulndb-0.0.20250908T141310-1.1 on GA media

WID-SEC-W-2025-1922 — Rancher: Schwachstelle ermöglicht Denial of Service

2026-10-03T16:38:53.658708+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Rancher ausnutzen, um einen Denial of Service Angriff durchzuführen.