CVE-2026-76235High· 7.5▾ TwilightA memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.8%
Last analysed / modified upstream
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)devspaces/udi-base-rhel10devspaces/udi-base-rhel9devspaces/udi-rhel9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Restrict network access to the cockpit port to trusted clients until a fix is available. No configuration-level mitigation removes the flaw entirely, since the login page must remain reachable without authentication.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91147Medium· 5.9A flaw was found in `cockpit-ws`
CVE-2026-91149High· 7.5A flaw was found in Cockpit
CVE-2024-6126Low· 3.2Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option
CVE-2024-2947High· 7.3Cockpit: command injection when deleting a sosreport with a crafted name
CVE-2023-7192Medium· 5.5Kernel: refcount leak in ctnetlink_create_conntrack()
CVE-2026-4802High· 8.0Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui