RHSA-2026:98567: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.Security Fix(es): cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147) cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149) cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in sendloginhtml (CVE-2026-76235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpitto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-docto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-packagekitto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-storagedto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-systemto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-wsto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3 - Upgrade
Upgrade
redhat/cockpitto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3.aa - Upgrade
Upgrade
redhat/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3.aa - Upgrade
Upgrade
redhat/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3.aa - Upgrade
Upgrade
redhat/cockpit-wsto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3.aa - Upgrade
Upgrade
redhat/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 366.1-1.el10_3.aa
Event History
Frequently Asked Questions
Which Cockpit component is directly exposed to these denial-of-service and memory-leak issues?
The affected issues are associated with cockpit-ws, including URL-root handling, unbounded connection-thread spawning, and unauthenticated memory leakage during login HTML handling.
Can an unauthenticated remote attacker trigger any of the reported issues?
Yes. The CockpitLang-cookie memory leak in cockpit-ws is described as unauthenticated and remote. The supplied advisory text does not specify authentication requirements for the two denial-of-service issues.
Which installed packages should be reviewed when applying this update?
The advisory lists cockpit, cockpit-ws, cockpit-ws-selinux, cockpit-bridge, cockpit-packagekit, cockpit-doc, cockpit-debuginfo, and cockpit-debugsource.