CVE-2026-76235 PUBLISHED

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

Assigner: redhat
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: unaffected
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: unaffected
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: unaffected

Workarounds

Restrict network access to the cockpit port to trusted clients until a fix is available. No configuration-level mitigation removes the flaw entirely, since the login page must remain reachable without authentication.

Credits

  • Red Hat would like to thank Arpit Jain for reporting this issue.

References

Problem Types

  • Missing Release of Memory after Effective Lifetime CWE