Security Advisory catalog CVE-2026-76235 Historical advisory recorded 11 Nov 2026 14:57:26 UTC. Read the latest advisory .
cve-program · CVE-2026-76235 Published
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-76235 Published cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4-1.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:310.10-1.el8_10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4-1.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4-1.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
} devspaces/udi-base-rhel10 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-base-rhel10",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
} devspaces/udi-base-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-base-rhel9",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
} devspaces/udi-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-rhel9",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
} Original source record · Cite this exact observation · Complete original publisher JSON