A flaw was found in cockpit-ws. The sendloginhtml() function in src/ws/cockpithandlers.c reads the CockpitLang cookie via cockpitwebserverparsecookie(), which returns a heap-allocated string (via guriunescapesegment, transfer-full ownership). On this code path, the function's only cleanup call is gstrfreev(languages), but languages remains NULL when the value came from the cookie rather than the Accept-Language header, so the allocated 'language' string is never freed. Every unauthenticated GET request to the login page carrying a CockpitLang cookie leaks one heap allocation sized by the (attacker-controlled) decoded cookie value, up to Cockpit's ~8192-byte request-size cap. Sustained requests grow the shared cockpit-ws process's memory without bound, eventually causing it to be OOM-killed and disrupting all users of that instance, not just the attacker.
Candidate upstream fix (Martin Vollmer): if (languages) gstrfreev (languages); else gfree (language);
A flaw was found in cockpit-ws. The sendloginhtml() function in src/ws/cockpithandlers.c reads the CockpitLang cookie via cockpitwebserverparsecookie(), which returns a heap-allocated string (via guriunescapesegment, transfer-full ownership). On this code path, the function's only cleanup call is gstrfreev(languages), but languages remains NULL when the value came from the cookie rather than the Accept-Language header, so the allocated 'language' string is never freed. Every unauthenticated GET request to the login page carrying a CockpitLang cookie leaks one heap allocation sized by the (attacker-controlled) decoded cookie value, up to Cockpit's ~8192-byte request-size cap. Sustained requests grow the shared cockpit-ws process's memory without bound, eventually causing it to be OOM-killed and disrupting all users of that instance, not just the attacker.
Candidate upstream fix (Martin Vollmer): if (languages) gstrfreev (languages); else gfree (language);
A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.