{"id":"CVE-2026-76235","aliases":["ALSA-2026:94485","ALSA-2026:94533","DEBIAN-CVE-2026-76235","EUVD-2026-62393","GHSA-hwfh-3wjq-8p68","MGASA-2026-0408","OESA-2026-3578","RLSA-2026:94485","RLSA-2026:94533","RLSA-2026:96250","UBUNTU-CVE-2026-76235"],"status":"published","title":"Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00585,"percentile":0.48296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2026-08-19T12:44:55Z","modified":"2026-11-11T13:11:49Z","fixes":[{"ecosystem":"Debian:13","package":"cockpit","fixed_in":["337-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cockpit","fixed_in":["366-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"cockpit","fixed_in":["356.2-1.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"cockpit","fixed_in":["356.2-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"cockpit","fixed_in":["309-12.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"cockpit","fixed_in":["309-12.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"cockpit","fixed_in":["178-15.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"cockpit","fixed_in":["178-19.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"cockpit","fixed_in":["309-12.oe2403sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.10-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.10-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.10-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.10-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.10-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.4-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["287-1","287.1-0+deb12u1","287.1-0+deb12u2","287.1-0+deb12u3","288.1-1","289-1","290-1","291-1","292-1","293-1","294-1","294.1-1","295-1","296-1","297-1","297-1~bpo12+1","298-1","299-1","299-1~bpo12+1","300-1","300.1-1","300.1-1~bpo12+1","301-1","301-1~bpo12+1","302-1","303-1","303-1~bpo12+1","304-1","305-1","305-1~bpo12+1","306-1","306-1~bpo12+1","307-1","307-1~bpo12+1","308-1","308-1~bpo12+1","309-1","309-1~bpo12+1","310-1","310.1-1","310.1-1~bpo12+1","311-1","311-1~bpo12+1","312-1","313-1","314-1","316-1","317-1","317-2","317-3","317-4","317-5","318-1","318-2","318-3","318-4","318-4~bpo12+1","319-1","319-1~bpo12+1","320-1","320-1~bpo12+1","321-1","322-1","322-1~bpo12+1","323-1","323-1~bpo12+1","324-1","324-1~bpo12+1","325-1","325-1~bpo12+1","326-1","327-1","327-1~bpo12+1","328-1","329-1","329-1~bpo12+1","330-1","330-2","330-3","330-4","331-1","331-1~bpo12+1","332-1","333-1","333-1~bpo12+1","334-1","335-1","335-2","335-2~bpo12+1","336-1","337-1","337-1~bpo12+1","338-1","339-1","340-1","341.1-1","342-1","343-1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","352-1","352-1~bpo13+1","353.1-1","353.1-1~bpo13+1","354-1","354-1~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","358-1","358-1~bpo13+1","360-1","360-1~bpo13+1","362-1","362-1~bpo13+1","365-1","365-1~bpo13+1","366-1","366-1~bpo13+1","367-1","367-1~bpo13+1","368-1","368-1~bpo13+1","370-1","370-1~bpo13+1","371-1","371-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"337-1+deb13u2"}]}],"versions":["337-1","337-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"366-1"}]}],"versions":["337-1","338-1","339-1","340-1","341.1-1","342-1","343-1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","352-1","352-1~bpo13+1","353.1-1","353.1-1~bpo13+1","354-1","354-1~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","358-1","358-1~bpo13+1","360-1","360-1~bpo13+1","362-1","362-1~bpo13+1","365-1","365-1~bpo13+1","366-1~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-12.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-12.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-15.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"178-19.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.10-1.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.4-1.el9_8.rocky.0.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.4-1.el10_2.rocky.0.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["151-1","156-1","157-1","158-1","160-1","161-1","162-1","163-1","164-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["202.1-1","204-1","206-1","207-1","208-1","210-1","211-1","212-1","213-1","214.1-1","215-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["252-1","256-1","257-1","258-1","259-1","260-1","261-1","262-1","263-1","264-1","264-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["300.1-1","303-1","304-1","305-1","306-1","307-1","308-1","309-1","310.1-1","311-1","312-1build2","314-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["360-1","362-1","365-1","367-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["346-1","348-1","350-1","352-1","353.1-1","354-1","355-1","356-1","360-1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift dev spaces"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:94485","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94533","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96250","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98463","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76235","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519497","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76235","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hwfh-3wjq-8p68"},{"url":"https://access.redhat.com/security/cve/CVE-2026-91147","tags":["report"]},{"url":"https://bugzilla.redhat.com/2479230","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519497","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-94485.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-91149","tags":["report"]},{"url":"https://bugzilla.redhat.com/2479422","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-94533.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-76235","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0408.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36207","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00385.html","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/pull/23633","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KV2ED2IAJAGOAIPNS3HQS7G4KHJANP3C/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3578","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94485","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479230","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94533","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479422","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96250","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-76235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76235","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-76235","title":"Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","status":"published","published":"2026-08-19T12:44:55.68Z","modified":"2026-11-11T13:11:49.966Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-11T14:28:43.346708Z"}],"euvd":[{"id":"EUVD-2026-62393","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","status":"published","published":"2026-08-19T12:44:55Z","modified":"2026-11-11T13:11:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T14:28:59.314266Z"}],"ghsa":[{"id":"GHSA-hwfh-3wjq-8p68","title":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on...","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","status":"published","published":"2026-08-19T15:32:25Z","modified":"2026-11-11T15:30:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-11T15:34:47.187237Z"}],"nvd":[{"id":"CVE-2026-76235","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","status":"published","published":"2026-08-19T13:18:11.637Z","modified":"2026-11-11T13:17:27.36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-11T15:25:14.7229Z"}],"osv":[{"id":"DEBIAN-CVE-2026-76235","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","status":"published","published":"2026-08-19T13:18:11.637Z","modified":"2026-11-10T09:47:43.356729517Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T10:26:30.347596Z"},{"id":"OESA-2026-3578","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse.\r\n\r\nSecurity Fix(es):\n\nA memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.(CVE-2026-76235)","status":"published","published":"2026-08-30T04:18:28Z","modified":"2026-08-30T04:32:17.194057382Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RLSA-2026:94485","title":"Moderate: cockpit security, bug fix, and enhancement update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)\n\n* cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)\n\nBug Fix(es) and Enhancement(s):\n\n* [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:Rocky Linux-246964)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-04T09:02:26.16622Z","modified":"2026-11-04T09:45:02.462506472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"RLSA-2026:94533","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)\n\n* cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)\n\n* cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-04T09:06:07.045237Z","modified":"2026-11-04T09:45:02.452026902Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"RLSA-2026:96250","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)\n\n* cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)\n\n* cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.468096717Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"UBUNTU-CVE-2026-76235","description":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.","status":"published","published":"2026-08-19T13:18:00Z","modified":"2026-10-17T13:01:06.808225318Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ALSA-2026:94485","title":"Moderate: cockpit security, bug fix, and enhancement update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  \n\nSecurity Fix(es):  \n\n  * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)\n  * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T16:45:03.668237057Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"ALSA-2026:94533","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  \n\nSecurity Fix(es):  \n\n  * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)\n  * cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)\n  * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T16:45:02.617050208Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"MGASA-2026-0408","title":"Updated cockpit packages fix a security vulnerability","description":"Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in\nsend_login_html. (CVE-2026-76235)\n","status":"published","published":"2026-09-16T15:40:01Z","modified":"2026-09-16T15:45:03.442704109Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}