Red Hat Security Advisory: cockpit security update

Fixed packages 10

Vulnerabilities 3

• High 7.5
  CVE-2026-76235

  Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

  A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of servi…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Aug 19, 2026
• High 7.5
  CVE-2026-91149

  Cockpit: cockpit: denial of service via unbounded connection thread spawning

  A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threa…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Sep 18, 2026
• Medium 5.9
  CVE-2026-91147

  Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

  A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root p…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Sep 18, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2479422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2519497
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98567.json
• report
  https://access.redhat.com/security/cve/CVE-2026-76235
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-76235
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-76235
• report
  https://access.redhat.com/security/cve/CVE-2026-91147
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-91147
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-91147
• report
  https://access.redhat.com/security/cve/CVE-2026-91149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-91149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-91149