Denial-of-Service Vulnerability in Rancher TLS Listeners

CVE-2026-55996

What is CVE-2026-55996?

A denial-of-service vulnerability exists in the TLS listeners of Rancher, specifically affecting the Rancher server and the cattle-cluster-agent component. The issue originates from the dynamiclistener library, which handles TLS traffic. Without a properly configured Common Name (CN) filter, the dynamiclistener appends incoming hostnames from Server Name Indication (SNI) to each serving certificate's Subject Alternative Name (SAN). This process allows an unauthenticated attacker within the same cluster network to send numerous TLS requests with unique hostnames, leading to an exhaustive addition of SANs to the certificate. Eventually, the size of the certificate exceeds limits during TLS handshakes, resulting in failures and a subsequent denial of service for the affected listeners.

References