This vulnerability affects the Rancher server and the cattle-cluster-agent component in downstream clusters, both of which use the dynamiclistener library to serve TLS traffic. Without an effective Common Name (CN) filter configured, dynamiclistener appends every hostname from incoming TLS requests' SNI to the serving certificate's SAN list. An attacker can exploit this by sending numerous TLS requests with unique hostnames, causing the certificate to accumulate an unbounded number of SANs. This growth leads to TLS handshake failures due to excessive message size errors, resulting in denial of service on the affected TLS listeners.

The vulnerability allows an unauthenticated attacker with network access within the affected cluster to cause a denial of service by overwhelming the TLS listeners with requests that cause certificate SAN lists to grow excessively. This leads to TLS handshake failures and disruption of service availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Until a fix is available, configuring an effective CN filter in dynamiclistener to restrict appended hostnames may mitigate the issue, but this is not confirmed by the vendor advisory.