The vulnerability arises because the audit logging middleware in SUSE Rancher reads the full HTTP request body into memory without enforcing size limits on public login endpoints. This middleware is executed before the APIBodyLimitingHandler, which normally caps request body size at 1 MiB. Consequently, attackers can send arbitrarily large payloads that cause the Rancher Manager server to allocate memory proportional to the request size. With a few concurrent large requests, this can exhaust server memory and terminate the Rancher Manager process, leading to denial of service and interruption of cluster management.

An unauthenticated attacker can exploit this vulnerability to cause uncontrolled memory consumption on the Rancher Manager server, resulting in process termination and denial of service. This disrupts the Rancher API and UI, preventing management of all downstream clusters. There is no impact on confidentiality or integrity reported, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling API audit logging if feasible or implementing external protections such as rate limiting or network-level controls to restrict large request bodies to the login endpoints.