Summary
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)
* cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
* cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 25
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | cockpit | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-bridge | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debuginfo | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debuginfo | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debuginfo | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debuginfo | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debugsource | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debugsource | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debugsource | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-debugsource | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-doc | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-packagekit | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-storaged | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-system | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws-selinux | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws-selinux | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws-selinux | 0:366.1-1.el10_3.rocky.0.1 |
| Rocky Linux · 10 | cockpit-ws-selinux | 0:366.1-1.el10_3.rocky.0.1 |
Vulnerabilities 3
-
High 7.5
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of servi…
-
High 7.5
Cockpit: cockpit: denial of service via unbounded connection thread spawning
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threa…
-
Medium 5.9
Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash
A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root p…