CVE-2024-58259 Rancher affected by unauthenticated Denial of Service

What is CVE-2024-58259?

CVE-2024-58259 is a high-severity denial of service vulnerability in SUSE rancher, published on 2 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processing, leading to Denial of Service (DoS).

Weakness: CWE-770

Which versions are affected by CVE-2024-58259?

11 open source packages ship an affected version, including github.com/rancher/rancher.

How do I fix CVE-2024-58259?

Upgrade github.com/rancher/rancher to a fixed version for your release line: 0.0.0-20250813072957-aee95d4e2a41, 2.10.9, 2.11.5 or 2.12.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-58259 being exploited?

There is no known exploitation of CVE-2024-58259 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4h45-jpvh-6p5j, GO-2025-3923.