GHSA-pcrv-jgr3-f337HighCVSS 7.5
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior...
🔗 CVE IDs covered (1)
📋 Description
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
🔗 References (11)
- https://nvd.nist.gov/vuln/detail/CVE-2026-91150
- https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93
- https://access.redhat.com/security/cve/CVE-2026-91150
- https://bugzilla.redhat.com/show_bug.cgi?id=2478436
- https://github.com/cockpit-project/cockpit/releases/tag/372
- https://access.redhat.com/errata/RHSA-2026:99600
- https://access.redhat.com/errata/RHSA-2026:99603
- https://access.redhat.com/errata/RHSA-2026:99601
- https://access.redhat.com/errata/RHSA-2026:99602
- https://access.redhat.com/errata/RHSA-2026:99599
- https://github.com/advisories/GHSA-pcrv-jgr3-f337