{"id":"CVE-2026-76235","title":"Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html","summary":"A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and c…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-401"],"vendor":"Red Hat","product":"cockpit","affected":["cockpit (all versions)","cockpit (all versions)","cockpit (all versions)","cockpit (all versions)","cockpit (all versions)","devspaces/udi-base-rhel10","devspaces/udi-base-rhel9","devspaces/udi-rhel9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-25T01:50:16.317408Z"},"published":"2026-08-19","updated":"2026-11-06","sourceUpdated":"2026-11-06T00:44:04.196Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76235","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:94485","label":"RHSA-2026:94485"},{"url":"https://access.redhat.com/errata/RHSA-2026:94533","label":"RHSA-2026:94533"},{"url":"https://access.redhat.com/security/cve/CVE-2026-76235"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519497","label":"RHBZ#2519497"}],"tags":["cve.org"],"epss":0.00585,"epssPercentile":0.48142,"ingestedAt":"2026-11-05T20:33:06.640Z","slug":"CVE-2026-76235","body":"## Overview\n\nA memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.\n\n## Affected\n\n- `cockpit (all versions)`\n- `cockpit (all versions)`\n- `cockpit (all versions)`\n- `cockpit (all versions)`\n- `cockpit (all versions)`\n- `devspaces/udi-base-rhel10`\n- `devspaces/udi-base-rhel9`\n- `devspaces/udi-rhel9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRestrict network access to the cockpit port to trusted clients until a fix is available. No configuration-level mitigation removes the flaw entirely, since the login page must remain reachable without authentication.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}