UBUNTU-CVE-2026-91150: Medium severity ubuntu/cockpit vulnerability
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker does not need prior authentication. Any deployment where an attacker can reach the Cockpit WebSocket service is exposed to attempted exploitation.
What does an attacker need to do?
The attacker must send specially crafted fragmented WebSocket messages. The fragments can accumulate without a total-size limit, exhausting memory in the cockpit-ws service and causing denial of service.
How can I tell whether an attack is affecting my system?
The available information identifies unbounded memory exhaustion and denial of service in cockpit-ws. Monitor that service for abnormal or sustained memory growth and resulting service disruption.