{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acockpit_projectcockpit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cockpit_project:cockpit:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-91150"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cockpit"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Cockpit Project"],"content_html":"\u003cp\u003eA vulnerability exists in the Cockpit web-based server administration interface, specifically within the cockpit-ws service. The vulnerability, tracked as CVE-2026-91150, allows a remote attacker without authentication to send specially crafted fragmented WebSocket messages. Because the service does not enforce a total-size limit on these fragments, they accumulate in memory, leading to unbounded memory exhaustion and a subsequent denial of service.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial of service for the cockpit-ws service, rendering the administrative interface unavailable until the service is restarted or the memory pressure is relieved. The CVSS 3.1 base score for this vulnerability is 7.5.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDetection and mitigation efforts should focus on identifying unauthorized access to the Cockpit web interface. Monitor for an unusual volume of WebSocket connection attempts or sustained high memory consumption patterns associated with the cockpit-ws process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a connection to the target system web interface.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a WebSocket connection to the cockpit-ws service.\u003c/li\u003e\n\u003cli\u003eAttacker transmits a sequence of fragmented WebSocket messages.\u003c/li\u003e\n\u003cli\u003eService fails to validate the total size of incoming fragments.\u003c/li\u003e\n\u003cli\u003eService continues to buffer fragments in memory.\u003c/li\u003e\n\u003cli\u003eService exhausts available system memory.\u003c/li\u003e\n\u003cli\u003eService crashes or becomes unresponsive (Denial of Service).\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-11T20:06:03Z","date_published":"2026-11-11T20:06:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cockpit-dos-cve-2026-91150/","summary":"A vulnerability in the Cockpit web-based server administration interface allows remote, unauthenticated attackers to cause a denial of service via memory exhaustion.","title":"Cockpit: Denial of service via WebSocket fragmentation (CVE-2026-91150)","url":"https://feed.craftedsignal.io/briefs/2026-11-cockpit-dos-cve-2026-91150/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cockpit_project:cockpit:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}