RHSA-2026:94533: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.Security Fix(es): cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147) cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149) cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in sendloginhtml (CVE-2026-76235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpitto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-docto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-packagekitto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-storagedto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-systemto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-wsto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
redhat/cockpitto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-wsto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8.aa
Event History
Frequently Asked Questions
Does exploitation require authentication or local access?
The CockpitLang cookie memory leak in cockpit-ws is explicitly described as unauthenticated and remote. The provided advisory text does not state authentication or access requirements for the two denial-of-service issues.
Is there a documented workaround if updates cannot be applied immediately?
The provided advisory information does not list a workaround, mitigation, affected version range, or fixed package version. It only identifies the three security fixes and their associated CVEs.