CVE-2024-58259

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
SUSE	rancher	>= 2.12.0, < 2.12.1; >= 2.11.0, < 2.11.5; >= 2.10.0, < 2.10.9; >= 2.9.0, < 2.9.11; < 0.0.0-20250813072957-aee95d4e2a41

References

Timeline

Published: Sep 2, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-58269.8In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root c CVE-2024-582607.6A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can al CVE-2024-582617.5The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" mes CVE-2024-582625.1The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.CVE-2024-582635.3The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.CVE-2024-582647.5The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.CVE-2024-582654.3The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery CVE-2024-582669.8The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command inj CVE-2024-582678.0A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phish CVE-2024-582694.3A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and regis CVE-2024-58279.8Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL trai CVE-2024-582737.8Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute