The vulnerability in SUSE Rancher involves the dynamiclistener library used by both the cattle-cluster-agent component and the Rancher server to serve TLS traffic. Without proper CN filtering, the library appends every hostname from incoming TLS requests' SNI to the certificate's Subject Alternative Names (SANs). An attacker can exploit this by sending numerous TLS requests with unique hostnames, causing the certificate to accumulate an unbounded number of SANs. This leads to oversized TLS handshake messages that cause handshake failures and denial of service on the affected TLS listeners.

An unauthenticated attacker with network access within the affected cluster can cause a denial of service by overwhelming the TLS listeners with TLS handshake failures. This disrupts normal TLS communications for Rancher components using the dynamiclistener library, potentially impacting cluster operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing effective CN filtering on TLS listeners to prevent unbounded SAN accumulation. Monitor for unusual TLS handshake failures that may indicate exploitation attempts.