Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit | 0:310.10-1.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit-bridge | 0:310.10-1.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit-debuginfo | 0:310.10-1.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit-debugsource | 0:310.10-1.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit-doc | 0:310.10-1.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit-system | 0:310.10-1.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | cockpit-ws | 0:310.10-1.el8_10 |
Vulnerabilities 2
-
High 7.5
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of servi…
-
Medium 5.9
Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash
A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root p…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479230
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2519497
-
article
https://issues.redhat.com/browse/RHEL-246964
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94485.json
-
report
https://access.redhat.com/security/cve/CVE-2026-76235
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-76235
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-76235
-
report
https://access.redhat.com/security/cve/CVE-2026-91147
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-91147
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-91147