{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cockpit-ws/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-76235"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cockpit-ws"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eCVE-2026-76235 describes a memory exhaustion vulnerability (CWE-401) affecting the cockpit-ws component in Red Hat Enterprise Linux. The vulnerability resides in the login page handler, which improperly handles heap memory allocation when processing incoming requests containing a 'CockpitLang' cookie. A remote, unauthenticated attacker can repeatedly send requests with this specific cookie to trigger a memory leak, eventually leading to system resource exhaustion and a denial-of-service condition for the affected host. This issue affects various versions of Red Hat Enterprise Linux including RHEL 7, 8, 9, and 10. The vulnerability is classified with a CVSS 3.1 base score of 7.5.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running the cockpit-ws service (typically listening on TCP 9090).\u003c/li\u003e\n\u003cli\u003eAttacker initiates an unauthenticated HTTP connection to the Cockpit login endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request header containing the 'CockpitLang' cookie.\u003c/li\u003e\n\u003cli\u003eAttacker sends multiple requests in rapid succession to the login handler.\u003c/li\u003e\n\u003cli\u003eThe cockpit-ws service fails to release heap memory associated with the 'CockpitLang' header processing.\u003c/li\u003e\n\u003cli\u003eMemory usage on the host system grows until all available RAM is exhausted.\u003c/li\u003e\n\u003cli\u003eThe host experiences a service failure or system-wide denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial of service, rendering the Cockpit management interface and potentially other host services unresponsive. This affects systems deployed in production environments utilizing Red Hat Enterprise Linux 7, 8, 9, or 10.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the cockpit-ws package to the vendor-provided security update immediately (see Red Hat Bugzilla ID 2519497).\u003c/li\u003e\n\u003cli\u003eConfigure network firewalls to restrict access to TCP port 9090 to trusted management networks only to prevent unauthenticated access.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs or network traffic for anomalous volumes of requests targeting the Cockpit login path from single source IPs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T14:32:59Z","date_published":"2026-08-19T14:32:59Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cockpit-ws-dos/","summary":"A heap-based memory leak in the cockpit-ws service allows unauthenticated remote attackers to trigger a denial of service via malformed Cookie headers.","title":"Memory Exhaustion Denial of Service in cockpit-ws (CVE-2026-76235)","url":"https://feed.craftedsignal.io/briefs/2026-08-cockpit-ws-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cockpit-Ws","version":"https://jsonfeed.org/version/1.1"}