CVE-2026-91149: Denial of Service via Resource Exhaustion in Cockpit

A vulnerability identified as CVE-2026-91149 exists in the Cockpit server management software, specifically within the cockpit-tls component. The flaw allows an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. By initiating and sustaining a large volume of simultaneous connections to the cockpit-tls service, an attacker forces the application to spawn an unbounded number of detached threads. This process consumes excessive system resources, including memory and file descriptors, which eventually leads to the degradation or complete unavailability of the Cockpit service for legitimate users. Defenders should monitor for anomalous connection patterns directed at the Cockpit TLS port and evaluate infrastructure resilience against resource exhaustion attacks.

Impact

Successful exploitation results in the unavailability of the Cockpit interface, impacting system administrators' ability to perform server management tasks. While the attack is limited to a service-level denial of service, the widespread use of Cockpit across enterprise Linux environments makes this a significant availability risk.

Recommendation

Prioritize monitoring of the cockpit-tls service for abnormal connection counts and duration. Work with IT operations to ensure system resource limits are configured to mitigate the impact of thread-exhaustion events on the host OS.