Skip to content
Heist/ feed
Back to feed
High

Rancher affected by unauthenticated Denial of Service

Type: advisorySources: OSV

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-58259
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 22:15 UTC · Revision 1

Source evidence

Rancher affected by unauthenticated Denial of Service

core-osv · Original source

Published 2 Sept 2025, 11:53 UTC

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

osv:CVE-2024-58259
Complete source record
{
  "id": "f9d2c9a4ef1d24e3152ed91c489674e47ca686f5baf2811cea8d3d67cbea4802",
  "url": "https://osv.dev/vulnerability/CVE-2024-58259",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Rancher affected by unauthenticated Denial of Service",
    "summary": "A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).",
    "evidence": "osv:CVE-2024-58259",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2024-58259",
      "aliases": [
        "CVE-2024-58259",
        "GHSA-4h45-jpvh-6p5j",
        "GO-2025-3923"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/rancher/rancher",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8815e66bf2e4b528493cf11222f1a63f86305a9f"
                },
                {
                  "fixed": "ed376a3297314acae1206629dadd35c63e77c285"
                },
                {
                  "introduced": "4b8ab8c48d681f77065bf25e1fa502c652b94465"
                },
                {
                  "fixed": "07a90f09a491c1589991b83dfb665e055628aea0"
                },
                {
                  "introduced": "df45e368c82d4027410fa4700371982b9236b7c8"
                },
                {
                  "fixed": "fbff60f597b4d4e77ef86594594506ad8f6c95cf"
                },
                {
                  "introduced": "9e0cc54e7e3a924cf0ed5c5d4db0a6e53805c75e"
                },
                {
                  "fixed": "1daa918b630b4f1e2d47d70fb16bdb38a180619d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "2.12.0"
                      },
                      {
                        "fixed": "2.12.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "2.11.0"
                      },
                      {
                        "fixed": "2.11.5"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "2.10.0"
                      },
                      {
                        "fixed": "2.10.9"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "2.9.0"
                      },
                      {
                        "fixed": "2.9.11"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.9.10-hotfix-1e46.1",
            "v2.9.10",
            "v2.11.1",
            "v2.12.1-rc1",
            "v2.11.5-rc1",
            "v2.10.9-rc1",
            "v2.9.11-rc1",
            "v2.11.5-alpha3",
            "v2.12.1-alpha4",
            "v2.11.5-alpha2",
            "v2.9.11-alpha3",
            "v2.10.9-alpha2",
            "v2.12.1-alpha3",
            "v2.12.1-alpha2",
            "v2.9.11-alpha2",
            "v2.12.1-alpha1",
            "v2.11.5-alpha1",
            "v2.10.9-alpha1",
            "v2.11.4",
            "v2.11.3",
            "v2.12.0",
            "v2.10.8",
            "v2.10.8-rc1",
            "v2.11.4-rc1",
            "v2.10.8-alpha4",
            "v2.11.4-alpha5",
            "v2.11.4-alpha4",
            "v2.10.8-alpha3",
            "v2.10.7",
            "v2.10.8-alpha2",
            "v2.11.4-alpha3",
            "v2.11.4-alpha2",
            "v2.10.8-alpha1",
            "v2.11.4-alpha1",
            "v2.9.11-alpha1",
            "v2.11.3-rc1",
            "v2.10.7-rc1",
            "v2.11.3-alpha3",
            "v2.10.7-alpha3",
            "v2.10.7-alpha2",
            "v2.11.3-alpha2",
            "v2.11.3-alpha1",
            "v2.10.7-alpha1",
            "v2.11.2",
            "v2.10.6",
            "v2.9.10-rc1",
            "v2.10.6-rc1",
            "v2.11.2-rc2",
            "v2.11.2-rc1",
            "v2.10.6-alpha6",
            "v2.11.2-alpha4",
            "v2.10.6-alpha5",
            "v2.10.6-alpha4",
            "v2.10.6-alpha3",
            "v2.11.2-alpha3",
            "v2.9.10-alpha1",
            "v2.11.2-alpha2",
            "v2.10.6-alpha2",
            "v2.10.6-alpha1",
            "v2.11.2-alpha1",
            "v2.9.9",
            "v2.10.5",
            "v2.10.5-rc1",
            "v2.11.1-rc2",
            "v2.9.9-rc1",
            "v2.11.1-rc1",
            "v2.9.9-alpha2",
            "v2.10.5-alpha4",
            "v2.11.1-alpha3",
            "v2.9.9-alpha1",
            "v2.10.5-alpha3",
            "v2.11.1-alpha2",
            "v2.10.5-alpha2",
            "v2.11.1-alpha1",
            "v2.10.5-alpha1",
            "v2.10.4",
            "v2.11.0",
            "v2.9.8",
            "v2.9.4-hotfix-schema-leak.1",
            "v2.9.4",
            "v2.10.4-rc1",
            "v2.9.8-rc1",
            "v2.10.4-alpha4",
            "v2.10.2",
            "v2.10.4-alpha3",
            "v2.9.8-alpha2",
            "v2.10.4-alpha2",
            "v2.9.8-alpha1",
            "v2.10.4-alpha1",
            "v2.10.3",
            "v2.9.7",
            "v2.9.7-rc1",
            "v2.10.3-rc1",
            "v2.9.7-alpha3",
            "v2.9.7-alpha2",
            "v2.10.3-alpha2",
            "v2.10.3-alpha1",
            "v2.9.7-alpha1",
            "v2.9.6",
            "v2.9.6-rc1",
            "v2.10.2-rc1",
            "v2.10.2-alpha4",
            "v2.9.6-alpha3",
            "v2.10.2-alpha3",
            "v2.10.2-alpha2",
            "v2.9.6-alpha2",
            "v2.10.2-alpha1",
            "v2.9.6-alpha1",
            "v2.9.5",
            "v2.10.1",
            "v2.10.1-rc1",
            "v2.9.5-rc1",
            "v2.10.1-alpha1",
            "v2.9.5-alpha1",
            "v2.10.0",
            "v2.9.4-rc3",
            "v2.9.4-rc2",
            "v2.9.4-rc1",
            "v2.9.4-alpha5",
            "v2.9.4-alpha4",
            "v2.9.4-alpha3",
            "v2.9.4-alpha2",
            "v2.9.4-alpha1",
            "v2.9.3",
            "v2.9.3-rc2",
            "v2.9.3-rc1",
            "v2.9.3-alpha7",
            "v2.9.3-alpha6",
            "v2.9.3-alpha5",
            "v2.9.3-alpha4",
            "v2.9.3-alpha3",
            "v2.9.3-alpha2",
            "v2.9.3-alpha1",
            "v2.9.2",
            "v2.9.2-rc1",
            "v2.9.2-alpha7",
            "v2.9.2-alpha6",
            "v2.9.2-alpha5",
            "v2.9.2-alpha4",
            "v2.9.2-alpha3",
            "v2.9.2-alpha2",
            "v2.9.2-alpha1",
            "v2.9.1",
            "v2.9.1-rc6",
            "v2.9.1-rc5",
            "v2.9.1-rc4",
            "v2.9.1-alpha2",
            "v2.9.1-rc3",
            "v2.9.1-rc2",
            "v2.9.1-rc1",
            "v2.9.1-alpha1",
            "v2.9.0-rc6",
            "v2.9.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58259.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:24.024516101Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58259.json",
        "https://github.com/rancher/rancher/security/advisories/GHSA-4h45-jpvh-6p5j",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-58259",
        "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58259"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-770"
        ],
        "cna_assigner": "suse",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "0.0.0-20250813072957-aee95d4e2a41"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58259.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-58259",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490467,
  "published_at": "2025-09-02T11:53:03.928+00:00"
}