Security Advisory catalog CVE-2026-91149
cve-program · CVE-2026-91149 Published
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-91149 Published cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4-1.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el10_3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.3"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4-1.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:356.4-1.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"versions": [
{
"version": "0:366.1-1.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
]
} cockpit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cockpit",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
} devspaces/udi-base-rhel10 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-base-rhel10",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
} devspaces/udi-base-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-base-rhel9",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
} devspaces/udi-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/udi-rhel9",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
} Original source record · Cite this exact observation · Complete original publisher JSON