Cockpit: Denial of service via WebSocket fragmentation (CVE-2026-91150)

A vulnerability exists in the Cockpit web-based server administration interface, specifically within the cockpit-ws service. The vulnerability, tracked as CVE-2026-91150, allows a remote attacker without authentication to send specially crafted fragmented WebSocket messages. Because the service does not enforce a total-size limit on these fragments, they accumulate in memory, leading to unbounded memory exhaustion and a subsequent denial of service.

Impact

Successful exploitation results in a denial of service for the cockpit-ws service, rendering the administrative interface unavailable until the service is restarted or the memory pressure is relieved. The CVSS 3.1 base score for this vulnerability is 7.5.

Recommendation

Detection and mitigation efforts should focus on identifying unauthorized access to the Cockpit web interface. Monitor for an unusual volume of WebSocket connection attempts or sustained high memory consumption patterns associated with the cockpit-ws process.

Attack Chain

1. Attacker establishes a connection to the target system web interface.
2. Attacker initiates a WebSocket connection to the cockpit-ws service.
3. Attacker transmits a sequence of fragmented WebSocket messages.
4. Service fails to validate the total size of incoming fragments.
5. Service continues to buffer fragments in memory.
6. Service exhausts available system memory.
7. Service crashes or becomes unresponsive (Denial of Service).