GHSA-3m8q-36jp-wgm3HighCVSS 7.5
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by...
🔗 CVE IDs covered (1)
📋 Description
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-91149
- https://access.redhat.com/security/cve/CVE-2026-91149
- https://bugzilla.redhat.com/show_bug.cgi?id=2479422
- https://access.redhat.com/errata/RHSA-2026:94533
- https://access.redhat.com/errata/RHSA-2026:96250
- https://access.redhat.com/errata/RHSA-2026:98463
- https://access.redhat.com/errata/RHSA-2026:98567
- https://github.com/advisories/GHSA-3m8q-36jp-wgm3