The vulnerability arises because the audit middleware in SUSE Rancher reads the entire HTTP request body into memory without enforcing size limits on login endpoints. Positioned earlier than the APIBodyLimitingHandler, it bypasses the default 1 MiB cap for requests passing through the audit copyReqBody path. An unauthenticated attacker can exploit this by sending large request bodies, causing the Rancher Manager server to allocate excessive memory. This can lead to memory exhaustion and termination of the Rancher Manager process, rendering the Rancher API and UI unavailable and interrupting management of downstream clusters.

An unauthenticated attacker can cause a denial of service by exhausting server memory through large request bodies sent to login endpoints, resulting in the termination of the Rancher Manager process. This disrupts the availability of Rancher's API and UI and interrupts management operations for all downstream clusters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling API audit logging on public login endpoints or implementing external protections such as rate limiting or web application firewalls to limit request body sizes.