High severityNVD Advisory· Published Sep 19, 2023· Updated Sep 25, 2024

CVE-2023-32186

Description

A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/rancher/rke2Go	< 1.24.17	1.24.17
github.com/rancher/rke2Go	>= 1.25.0, < 1.25.13	1.25.13
github.com/rancher/rke2Go	>= 1.26.0, < 1.26.8	1.26.8
github.com/rancher/rke2Go	>= 1.27.0, < 1.27.5	1.27.5
github.com/rancher/rke2Go	>= 1.28.0, < 1.28.1	1.28.1

Affected products

ghsa-coords
pkg:golang/github.com/rancher/rke2
Range: < 1.24.17
SUSE S.A./RKE2cpe-rescue
Range: 1.24.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p45j-vfv5-wprqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-32186ghsaADVISORY
bugzilla.suse.com/show_bug.cgighsaWEB
github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprqghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000