CVE-2026-91150
Cockpit: cockpit: denial of service via unbounded fragmented websocket messages
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cockpit: cockpit: denial of service via unbounded fragmented websocket messages
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
CVE-2026-91150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-12
EUVDEUVD-2026-123707
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
EUVD-2026-123707- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-pcrv-jgr3-f337
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior...
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
GHSA-pcrv-jgr3-f337- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-12
NVD
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
CVE-2026-91150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-12
OSV
Cockpit: cockpit: denial of service via unbounded fragmented websocket messages
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
CVE-2026-91150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-13
OSVDEBIAN-CVE-2026-91150
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
DEBIAN-CVE-2026-91150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:99603
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper (CVE-2026-91151)
cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages (CVE-2026-91150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:99603- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-91150No score
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
- Record
UBUNTU-CVE-2026-91150- Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cockpitDebian:12 | All versions, plus listed versions 287-1287.1-0+deb12u1287.1-0+deb12u2287.1-0+deb12u3288.1-1 Show 45 moreShow less289-1290-1291-1292-1293-1294-1294.1-1295-1296-1297-1297-1~bpo12+1298-1299-1299-1~bpo12+1300-1300.1-1300.1-1~bpo12+1301-1301-1~bpo12+1302-1303-1303-1~bpo12+1304-1305-1305-1~bpo12+1306-1306-1~bpo12+1307-1307-1~bpo12+1308-1308-1~bpo12+1309-1309-1~bpo12+1310-1310.1-1310.1-1~bpo12+1311-1311-1~bpo12+1312-1313-1314-1316-1317-1317-2317-3 | None known |
cockpitDebian:13 | All versions, plus listed versions 337-1337-1+deb13u1337-1+deb13u2338-1339-1 Show 41 moreShow less340-1341.1-1342-1343-1345-1345-1~bpo13+1346-1346-1~bpo13+1348-1348-1~bpo13+1350-1350-1~bpo13+1352-1352-1~bpo13+1353.1-1353.1-1~bpo13+1354-1354-1~bpo13+1355-1355-1~bpo13+1356-1356-1~bpo13+1358-1358-1~bpo13+1360-1360-1~bpo13+1362-1362-1~bpo13+1365-1365-1~bpo13+1366-1366-1~bpo13+1367-1367-1~bpo13+1368-1368-1~bpo13+1370-1370-1~bpo13+1371-1371-1~bpo13+1372-1 | None known |
cockpitDebian:14 | before 372-1, plus listed versions 337-1338-1339-1340-1341.1-1 Show 38 moreShow less342-1343-1345-1345-1~bpo13+1346-1346-1~bpo13+1348-1348-1~bpo13+1350-1350-1~bpo13+1352-1352-1~bpo13+1353.1-1353.1-1~bpo13+1354-1354-1~bpo13+1355-1355-1~bpo13+1356-1356-1~bpo13+1358-1358-1~bpo13+1360-1360-1~bpo13+1362-1362-1~bpo13+1365-1365-1~bpo13+1366-1366-1~bpo13+1367-1367-1~bpo13+1368-1368-1~bpo13+1370-1370-1~bpo13+1371-1371-1~bpo13+1 | 372-1 |
cockpitRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
cockpit-bridgeRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
cockpit-debuginfoRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
cockpit-debugsourceRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
cockpit-wsRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
cockpit-docRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
cockpit-systemRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10.2-1.el8_10 | 0:310.10.2-1.el8_10 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cockpitUbuntu:18.04:LTS | All versions, plus listed versions 151-1156-1157-1158-1160-1 Show 4 moreShow less161-1162-1163-1164-1 | None known |
cockpitUbuntu:20.04:LTS | All versions, plus listed versions 202.1-1204-1206-1207-1208-1 Show 6 moreShow less210-1211-1212-1213-1214.1-1215-1 | None known |
cockpitUbuntu:22.04:LTS | All versions, plus listed versions 252-1256-1257-1258-1259-1 Show 6 moreShow less260-1261-1262-1263-1264-1264-1ubuntu0.22.04.1 | None known |
cockpitUbuntu:24.04:LTS | All versions, plus listed versions 300.1-1303-1304-1305-1306-1 Show 7 moreShow less307-1308-1309-1310.1-1311-1312-1build2314-1 | None known |
cockpitUbuntu:26.10 | All versions, plus listed versions 360-1362-1365-1367-1 | None known |
cockpitUbuntu:26.04:LTS | All versions, plus listed versions 346-1348-1350-1352-1353.1-1 Show 4 moreShow less354-1355-1356-1360-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | OSV | |
| references | OSV | |
| affected, aliases, references | EUVD, GitHub Advisories, NVD, OSV | |
| products, references | CVE List, GitHub Advisories, NVD | |
| references | CVE List | |
| products, references | EUVD | |
| references | CVE List, EUVD, NVD | |
| references | CVE List | |
| references | GitHub Advisories |
Show 6 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected, published | EUVD, OSV | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, products, references, severity, title | CVE List | |
| aliases, description, references, severity | EUVD | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91150 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in cockpit 372-1.
References
access.redhat.com/errata/RHSA-2026:99599
Show 12 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2478436
github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93
nvd.nist.gov/vuln/detail/CVE-2026-91150
security-tracker.debian.org/tracker/CVE-2026-91150
errata.rockylinux.org/RLSA-2026:99603
ubuntu.com/security/CVE-2026-91150
cve.org/CVERecord?id=CVE-2026-91150
Left out here: 85 versions. The JSON record has them.