A flaw was found in cockpit-ws. The sendloginhtml() function in src/ws/cockpithandlers.c reads the CockpitLang cookie via cockpitwebserverparsecookie(), which returns a heap-allocated string (via guriunescapesegment, transfer-full ownership). On this code path, the function's only cleanup call is gstrfreev(languages), but languages remains NULL when the value came from the cookie rather than the Accept-Language header, so the allocated 'language' string is never freed. Every unauthenticated GET request to the login page carrying a CockpitLang cookie leaks one heap allocation sized by the (attacker-controlled) decoded cookie value, up to Cockpit's ~8192-byte request-size cap. Sustained requests grow the shared cockpit-ws process's memory without bound, eventually causing it to be OOM-killed and disrupting all users of that instance, not just the attacker.

Candidate upstream fix (Martin Vollmer): if (languages) gstrfreev (languages); else gfree (language);

A flaw was found in cockpit-ws. The sendloginhtml() function in src/ws/cockpithandlers.c reads the CockpitLang cookie via cockpitwebserverparsecookie(), which returns a heap-allocated string (via guriunescapesegment, transfer-full ownership). On this code path, the function's only cleanup call is gstrfreev(languages), but languages remains NULL when the value came from the cookie rather than the Accept-Language header, so the allocated 'language' string is never freed. Every unauthenticated GET request to the login page carrying a CockpitLang cookie leaks one heap allocation sized by the (attacker-controlled) decoded cookie value, up to Cockpit's ~8192-byte request-size cap. Sustained requests grow the shared cockpit-ws process's memory without bound, eventually causing it to be OOM-killed and disrupting all users of that instance, not just the attacker.

Candidate upstream fix (Martin Vollmer): if (languages) gstrfreev (languages); else gfree (language);