Rancher Unauthenticated Memory Exhaustion DoS Fix (CVE-2025-59675)

Vulnerability Overview Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service Vulnerability Type: Unauthenticated Memory Exhaustion Denial of Service (DoS) Severity: High (CVSS 7.5/10) CVE ID: CVE-2025-59675 Discovered by: securityravened@proton.me Scope of Impact Affected Versions: - >=2.14.0, =2.13.0, =2.12.0, <2.12.12 Vulnerability Description: - In Rancher’s API audit log middleware ( ), when API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing any size limits. - Because the audit middleware is positioned before Rancher’s , an attacker can send request bodies of arbitrary size, causing the Rancher Manager server process to allocate memory proportional to the request body size. - With just a few concurrent connections, an attacker can exhaust available memory, causing the Rancher Manager process to crash. This results in the unavailability of the Rancher API and UI, and disrupts all downstream clusters. Remediation Patch Versions: - 2.14.4 - 2.13.8 - 2.12.12 Patch Details: - The patch limits the function in the audit middleware ( ) when reading request bodies for the login endpoint. - The previously unrestricted call has been replaced with a read limit configured to match Rancher’s defined in (default set to 1MB). - Request bodies exceeding this limit are truncated rather than fully read, preventing memory exhaustion. Additional Information Prerequisites: - API audit logging must be enabled on the Rancher server ( / ). - The attacker requires network access to the Rancher management HTTPS endpoint and does not need credentials, tokens, or prior account access. Mitigations: - No mitigations available. More Information: - Contact the SUSE Rancher Security team for security-related issues. - Open an issue in the Rancher repository. - Review the supported matrix and product support lifecycle. Code Block No POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Unauthenticated Memory Exhaustion DoS Fix (CVE-2025-59675)

More from this source