CVE-2026-76235
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
CVE-2026-76235 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in cockpit 337-1+deb13u2.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.63%EPSS, 50th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
337-1+deb13u2cockpit +88 more
Description
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cockpitAlmaLinux:8 From an advisory covering 2 CVEs | before 310.10-1.el8_10 | 310.10-1.el8_10 |
cockpit-bridgeAlmaLinux:8 From an advisory covering 2 CVEs | before 310.10-1.el8_10 | 310.10-1.el8_10 |
cockpit-docAlmaLinux:8 From an advisory covering 2 CVEs | before 310.10-1.el8_10 | 310.10-1.el8_10 |
cockpit-systemAlmaLinux:8 From an advisory covering 2 CVEs | before 310.10-1.el8_10 | 310.10-1.el8_10 |
cockpit-wsAlmaLinux:8 From an advisory covering 2 CVEs | before 310.10-1.el8_10 | 310.10-1.el8_10 |
cockpitAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-bridgeAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-docAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-packagekitAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-storagedAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
Show 79 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cockpit-systemAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-wsAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-ws-selinuxAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpitDebian:12 | All versions, plus listed versions 287-1287.1-0+deb12u1287.1-0+deb12u2287.1-0+deb12u3288.1-1 Show 45 moreShow less289-1290-1291-1292-1293-1294-1294.1-1295-1296-1297-1297-1~bpo12+1298-1299-1299-1~bpo12+1300-1300.1-1300.1-1~bpo12+1301-1301-1~bpo12+1302-1303-1303-1~bpo12+1304-1305-1305-1~bpo12+1306-1306-1~bpo12+1307-1307-1~bpo12+1308-1308-1~bpo12+1309-1309-1~bpo12+1310-1310.1-1310.1-1~bpo12+1311-1311-1~bpo12+1312-1313-1314-1316-1317-1317-2317-3 | None known |
cockpitDebian:13 | before 337-1+deb13u2, plus listed versions 337-1337-1+deb13u1 | 337-1+deb13u2 |
cockpitDebian:14 | before 366-1, plus listed versions 337-1338-1339-1340-1341.1-1 Show 29 moreShow less342-1343-1345-1345-1~bpo13+1346-1346-1~bpo13+1348-1348-1~bpo13+1350-1350-1~bpo13+1352-1352-1~bpo13+1353.1-1353.1-1~bpo13+1354-1354-1~bpo13+1355-1355-1~bpo13+1356-1356-1~bpo13+1358-1358-1~bpo13+1360-1360-1~bpo13+1362-1362-1~bpo13+1365-1365-1~bpo13+1366-1~bpo13+1 | 366-1 |
cockpitMageia:10 | before 356.2-1.1.mga10 | 356.2-1.1.mga10 |
cockpitMageia:9 | before 356.2-1.1.mga9 | 356.2-1.1.mga9 |
cockpitopenEuler:24.03-LTS-SP3 | before 309-12.oe2403sp3 | 309-12.oe2403sp3 |
cockpitopenEuler:24.03-LTS-SP4 | before 309-12.oe2403sp4 | 309-12.oe2403sp4 |
cockpitopenEuler:20.03-LTS-SP4 | before 178-15.oe2003sp4 | 178-15.oe2003sp4 |
cockpitopenEuler:22.03-LTS-SP4 | before 178-19.oe2203sp4 | 178-19.oe2203sp4 |
cockpitopenEuler:24.03-LTS-SP1 | before 309-12.oe2403sp1 | 309-12.oe2403sp1 |
cockpitRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-bridgeRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-debuginfoRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-debugsourceRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-docRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-systemRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-wsRed Hat:enterprise_linux:8::baseos From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpit-packagekitRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-storagedRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpitRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-bridgeRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-debugsourceRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-docRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-systemRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-wsRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-ws-selinuxRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-packagekitRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-storagedRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpitRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-bridgeRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-docRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-systemRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-wsRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-ws-selinuxRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-packagekitRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-storagedRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpitRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-bridgeRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-debugsourceRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-docRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-systemRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-wsRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-ws-selinuxRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-packagekitRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-storagedRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpitRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-bridgeRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-debugsourceRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-docRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-systemRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-wsRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-ws-selinuxRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpitRocky Linux:8 From an advisory covering 2 CVEs | before 0:310.10-1.el8_10 | 0:310.10-1.el8_10 |
cockpitRocky Linux:9 From an advisory covering 3 CVEs | before 0:356.4-1.el9_8.rocky.0.1 | 0:356.4-1.el9_8.rocky.0.1 |
cockpitRocky Linux:10 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2.rocky.0.1 | 0:356.4-1.el10_2.rocky.0.1 |
cockpit-packagekitRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-storagedRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-bridgeRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-docRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-systemRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-debuginfoRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-wsRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-debugsourceRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-ws-selinuxRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpitRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpitUbuntu:18.04:LTS | All versions, plus listed versions 151-1156-1157-1158-1160-1 Show 4 moreShow less161-1162-1163-1164-1 | None known |
cockpitUbuntu:20.04:LTS | All versions, plus listed versions 202.1-1204-1206-1207-1208-1 Show 6 moreShow less210-1211-1212-1213-1214.1-1215-1 | None known |
cockpitUbuntu:22.04:LTS | All versions, plus listed versions 252-1256-1257-1258-1259-1 Show 6 moreShow less260-1261-1262-1263-1264-1264-1ubuntu0.22.04.1 | None known |
cockpitUbuntu:24.04:LTS | All versions, plus listed versions 300.1-1303-1304-1305-1306-1 Show 7 moreShow less307-1308-1309-1310.1-1311-1312-1build2314-1 | None known |
cockpitUbuntu:26.10 | All versions, plus listed versions 360-1362-1365-1367-1 | None known |
cockpitUbuntu:26.04:LTS | All versions, plus listed versions 346-1348-1350-1352-1353.1-1 Show 4 moreShow less354-1355-1356-1360-1 | None known |
What each source reports
CVE List Score used
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
- Record
CVE-2026-76235- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-11
EUVDEUVD-2026-62393
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
- Record
EUVD-2026-62393- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-hwfh-3wjq-8p68
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on...
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
- Record
GHSA-hwfh-3wjq-8p68- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-11
NVD
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
- Record
CVE-2026-76235- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-76235
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
- Record
DEBIAN-CVE-2026-76235- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
OSVOESA-2026-3578
cockpit security update
Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse.
Security Fix(es):
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.(CVE-2026-76235)
- Record
OESA-2026-3578- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVRHSA-2026:94485
Red Hat Security Advisory: cockpit security, bug fix, and enhancement update
- Record
RHSA-2026:94485- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:94533
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:94533- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:96250
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:96250- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98463
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:98463- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98567
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:98567- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:94485
Moderate: cockpit security, bug fix, and enhancement update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
Bug Fix(es) and Enhancement(s):
- [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:Rocky Linux-246964)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:94485- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVRLSA-2026:94533
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:94533- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVRLSA-2026:96250
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:96250- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
OSVRLSA-2026:98567
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:98567- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-76235
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
- Record
UBUNTU-CVE-2026-76235- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:94485No score
Moderate: cockpit security, bug fix, and enhancement update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
- cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147) - cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
Bug Fix(es) and Enhancement(s):
- [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:94485- Updated
- 2026-11-04
OSVALSA-2026:94533No score
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
- cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147) - cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
- cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:94533- Updated
- 2026-11-04
OSVMGASA-2026-0408No score
Updated cockpit packages fix a security vulnerability
Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html. (CVE-2026-76235)
- Record
MGASA-2026-0408- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | GitHub Advisories, OSV | |
| references | CVE List, NVD | |
| references | EUVD, GitHub Advisories, NVD | |
| references | CVE List | |
| affected, aliases, references | GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| references | EUVD | |
| affected | OSV |
Show 7 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD | |
| affected, aliases, references | OSV | |
| affected, aliases, references | EUVD, NVD, OSV | |
| references | CVE List, EUVD, GitHub Advisories, NVD | |
| references | CVE List | |
| facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:94485
Show 36 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2519497
nvd.nist.gov/vuln/detail/CVE-2026-76235
github.com/advisories/GHSA-hwfh-3wjq-8p68
errata.almalinux.org/8/ALSA-2026-94485.html
security-tracker.debian.org/tracker/CVE-2026-76235
advisories.mageia.org/MGASA-2026-0408.html
bugs.mageia.org/show_bug.cgi?id=36207
lists.debian.org/debian-security-announce/2026/msg00385.html
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KV2ED2IAJAGOAIPNS3HQS7G4KHJANP3C
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3578
issues.redhat.com/browse/RHEL-246964
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94485.json
cve.org/CVERecord?id=CVE-2026-76235
errata.rockylinux.org/RLSA-2026:94485
ubuntu.com/security/CVE-2026-76235
Left out here: 85 versions. The JSON record has them.