This vulnerability allows an attacker with network access inside the cluster to flood TLS listeners with requests that carry many distinct hostnames via Server Name Indication. Because the dynamiclistener library automatically appends each supplied hostname to the serving certificate’s Subject Alternative Names when no Common Name filter is configured, the certificate grows without bound. Once the SAN field becomes too large, TLS handshakes fail with an excessive message size error, resulting in a denial of service on the affected listeners. The impact is limited to service disruption; there is no code execution or data exposure enumerated in the description.

The flaw is present in the Rancher server and the cattle‑cluster‑agent component in downstream clusters. Vendor information is listed under SUSE Rancher. No specific product versions or additional vendors are named in the provided data.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting limited observed exploitation. An attacker must be able to reach the affected TLS endpoints inside the cluster and does not need authentication. The risk is that a determined adversary can cause repeated service disruptions, potentially impacting multiple cluster nodes or the Rancher API endpoint. Guardrails such as limiting network access or applying a patch reduce the risk significantly.