CVE-2026-55996

Name of the Vulnerable Software and Affected Versions Rancher (affected versions not specified)

Description A denial-of-service issue exists in multiple TLS listeners within the Rancher server and the cattle-cluster-agent component. These components utilize the dynamiclistener library to handle TLS traffic. When a Common Name (CN) filter is not configured, the dynamiclistener automatically adds any hostname provided via Server Name Indication (SNI) to the serving certificate. An unauthenticated attacker with network access to the cluster can send numerous TLS requests with unique hostnames, causing the certificate to accumulate an excessive number of Subject Alternative Names (SANs). This results in the certificate becoming too large, leading to TLS handshake failures due to excessive message size and causing a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.