Every CVE Search/ Get API key

CVE-2026-76235

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

7.5 HighFix available

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.58%Up 0.2 points since Aug 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Record
CVE-2026-76235
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-06
EUVDEUVD-2026-62393 7.5

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Record
EUVD-2026-62393
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-hwfh-3wjq-8p68 7.5

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on...

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Record
GHSA-hwfh-3wjq-8p68
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-04
NVD 7.5

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Record
CVE-2026-76235
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-06
OSVDEBIAN-CVE-2026-76235 7.5

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Record
DEBIAN-CVE-2026-76235
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
OSVOESA-2026-3578 7.5

cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse.

Security Fix(es):

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.(CVE-2026-76235)

Record
OESA-2026-3578
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRLSA-2026:94485 7.5

Moderate: cockpit security, bug fix, and enhancement update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

  • cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147)

  • cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)

Bug Fix(es) and Enhancement(s):

  • [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:Rocky Linux-246964)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:94485
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVRLSA-2026:94533 7.5

Important: cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

  • cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147)

  • cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)

  • cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:94533
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVUBUNTU-CVE-2026-76235 7.5

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Record
UBUNTU-CVE-2026-76235
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:94485 No score

Moderate: cockpit security, bug fix, and enhancement update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

  • cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147)
  • cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)

Bug Fix(es) and Enhancement(s):

  • [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:94485
Updated
2026-11-04
OSVALSA-2026:94533 No score

Important: cockpit security update

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

  • cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147)
  • cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
  • cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:94533
Updated
2026-11-04
OSVMGASA-2026-0408 No score

Updated cockpit packages fix a security vulnerability

Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html. (CVE-2026-76235)

Record
MGASA-2026-0408
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cockpit
AlmaLinux:8
From an advisory covering 2 CVEs
 before 310.10-1.el8_10
310.10-1.el8_10
cockpit-bridge
AlmaLinux:8
From an advisory covering 2 CVEs
 before 310.10-1.el8_10
310.10-1.el8_10
cockpit-doc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 310.10-1.el8_10
310.10-1.el8_10
cockpit-system
AlmaLinux:8
From an advisory covering 2 CVEs
 before 310.10-1.el8_10
310.10-1.el8_10
cockpit-ws
AlmaLinux:8
From an advisory covering 2 CVEs
 before 310.10-1.el8_10
310.10-1.el8_10
cockpit
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit-bridge
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit-doc
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit-packagekit
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit-storaged
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
Show 21 moreShow less
Affected packages
PackageAffectedFixed
cockpit-system
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit-ws
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit-ws-selinux
AlmaLinux:9
From an advisory covering 3 CVEs
 before 356.4-1.el9_8
356.4-1.el9_8
cockpit
Debian:12
 All versions, plus listed versions
287-1287.1-0+deb12u1287.1-0+deb12u2287.1-0+deb12u3288.1-1
Show 45 moreShow less
289-1290-1291-1292-1293-1294-1294.1-1295-1296-1297-1297-1~bpo12+1298-1299-1299-1~bpo12+1300-1300.1-1300.1-1~bpo12+1301-1301-1~bpo12+1302-1303-1303-1~bpo12+1304-1305-1305-1~bpo12+1306-1306-1~bpo12+1307-1307-1~bpo12+1308-1308-1~bpo12+1309-1309-1~bpo12+1310-1310.1-1310.1-1~bpo12+1311-1311-1~bpo12+1312-1313-1314-1316-1317-1317-2317-3
 None known
cockpit
Debian:13
 before 337-1+deb13u2, plus listed versions
337-1337-1+deb13u1
337-1+deb13u2
cockpit
Debian:14
 before 366-1, plus listed versions
337-1338-1339-1340-1341.1-1
Show 29 moreShow less
342-1343-1345-1345-1~bpo13+1346-1346-1~bpo13+1348-1348-1~bpo13+1350-1350-1~bpo13+1352-1352-1~bpo13+1353.1-1353.1-1~bpo13+1354-1354-1~bpo13+1355-1355-1~bpo13+1356-1356-1~bpo13+1358-1358-1~bpo13+1360-1360-1~bpo13+1362-1362-1~bpo13+1365-1365-1~bpo13+1366-1~bpo13+1
366-1
cockpit
Mageia:10
 before 356.2-1.1.mga10
356.2-1.1.mga10
cockpit
Mageia:9
 before 356.2-1.1.mga9
356.2-1.1.mga9
cockpit
openEuler:24.03-LTS-SP3
 before 309-12.oe2403sp3
309-12.oe2403sp3
cockpit
openEuler:24.03-LTS-SP4
 before 309-12.oe2403sp4
309-12.oe2403sp4
cockpit
openEuler:20.03-LTS-SP4
 before 178-15.oe2003sp4
178-15.oe2003sp4
cockpit
openEuler:22.03-LTS-SP4
 before 178-19.oe2203sp4
178-19.oe2203sp4
cockpit
openEuler:24.03-LTS-SP1
 before 309-12.oe2403sp1
309-12.oe2403sp1
cockpit
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:310.10-1.el8_10
0:310.10-1.el8_10
cockpit
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:356.4-1.el9_8.rocky.0.1
0:356.4-1.el9_8.rocky.0.1
cockpit
Ubuntu:18.04:LTS
 All versions, plus listed versions
151-1156-1157-1158-1160-1
Show 4 moreShow less
161-1162-1163-1164-1
 None known
cockpit
Ubuntu:20.04:LTS
 All versions, plus listed versions
202.1-1204-1206-1207-1208-1
Show 6 moreShow less
210-1211-1212-1213-1214.1-1215-1
 None known
cockpit
Ubuntu:22.04:LTS
 All versions, plus listed versions
252-1256-1257-1258-1259-1
Show 6 moreShow less
260-1261-1262-1263-1264-1264-1ubuntu0.22.04.1
 None known
cockpit
Ubuntu:24.04:LTS
 All versions, plus listed versions
300.1-1303-1304-1305-1306-1
Show 7 moreShow less
307-1308-1309-1310.1-1311-1312-1build2314-1
 None known
cockpit
Ubuntu:26.10
 All versions, plus listed versions
360-1362-1365-1367-1
 None known
cockpit
Ubuntu:26.04:LTS
 All versions, plus listed versions
346-1348-1350-1352-1353.1-1
Show 4 moreShow less
354-1355-1356-1360-1
 None known

History

History
RecordedChangedSources
affectedOSV
affectedCVE List, EUVD, NVD
affected, aliases, referencesOSV
affected, aliases, referencesEUVD, NVD, OSV
referencesCVE List, EUVD, GitHub Advisories, NVD
referencesCVE List
facts, referencesGitHub Advisories
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-76235 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. Fixed in cockpit 337-1+deb13u2.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: 84 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open