RLSA-2026:94533: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147)
cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in sendloginhtml (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpitto a version that resolves this vulnerability.Fixed in 0:356.4-1.el9_8.rocky.0.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems are exposed to these issues?
Systems running the affected Rocky Linux cockpit package are exposed through Cockpit's web-facing cockpit-ws service. The listed flaws include denial-of-service conditions and an unauthenticated remote memory leak.
Does exploitation require authentication or user interaction?
No. The advisory's CVSS vector specifies no privileges required and no user interaction, and one issue is explicitly described as an unauthenticated remote memory leak.
What impact should operators expect from successful exploitation?
The advisory rates the update high severity with a 7.5 score and identifies availability impact as high. The disclosed issues can cause denial of service in cockpit-ws, including through URL-root handling and unbounded connection-thread spawning.
How can I determine whether this update applies to a host?
Check whether the host has the Rocky Linux cockpit package installed and whether its Cockpit web service is exposed. The advisory does not provide affected or fixed package version information.