CVE-2026-76235 Overview
A memory leak vulnerability exists in cockpit-ws, the web service component of the Cockpit Linux server management interface. The login page handler leaks a heap allocation on every unauthenticated request that includes a CockpitLang cookie. A remote unauthenticated attacker can send repeated crafted requests to exhaust host memory and trigger a denial of service condition. The flaw is tracked as CWE-401: Missing Release of Memory after Effective Lifetime.
Critical Impact
Remote unauthenticated attackers can exhaust server memory through repeated login requests carrying a CockpitLang cookie, causing denial of service on Cockpit-managed hosts.
Affected Products
- Red Hat Cockpit cockpit-ws component
- Linux distributions shipping vulnerable Cockpit web service builds
- Systems exposing Cockpit management interfaces to untrusted networks
Discovery Timeline
- 2026-08-19 - CVE-2026-76235 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76235
Vulnerability Analysis
Cockpit provides a web-based administrative interface for Linux servers through the cockpit-ws daemon. The daemon serves a login page to unauthenticated users and honors the CockpitLang cookie to select the user interface language.
The login page handler allocates memory on the heap during request processing but fails to free that allocation when a CockpitLang cookie is present. Each unauthenticated HTTP request that includes this cookie leaks a small heap allocation. Repeated requests accumulate leaked memory until the process or host exhausts available RAM.
Because the login endpoint requires no authentication and no user interaction, any network-reachable attacker can drive the leak. The impact is limited to availability; confidentiality and integrity are not affected.
Root Cause
The root cause is a missing release of heap memory after its effective lifetime [CWE-401]. The code path that parses the CockpitLang cookie inside the login handler allocates a buffer but omits the corresponding free call on the unauthenticated request path.
Attack Vector
Exploitation requires only network access to the Cockpit web service, typically TCP port 9090. An attacker issues repeated HTTP requests to the login page with a CockpitLang cookie set to any value. No credentials, tokens, or session state are needed. Automated tools can generate sufficient request volume to exhaust host memory over time, degrading or halting Cockpit and colocated services.
Refer to the Red Hat CVE-2026-76235 Advisory and Red Hat Bug Report #2519497 for upstream technical details.
Detection Methods for CVE-2026-76235
Indicators of Compromise
- Repeated unauthenticated HTTP requests to / or /login on cockpit-ws (TCP 9090) carrying a CockpitLang cookie from a single source or small set of sources.
- Steadily increasing resident set size (RSS) of the cockpit-ws process without a corresponding increase in authenticated sessions.
- Out-of-memory (OOM) killer entries in dmesg or journalctl referencing cockpit-ws.
Detection Strategies
- Monitor cockpit-ws process memory over time and alert on sustained growth that does not correlate with active user sessions.
- Inspect web access logs or reverse proxy logs for high-rate requests to Cockpit login endpoints that include the CockpitLang cookie.
- Correlate systemd service restarts of cockpit.service and cockpit-ws with preceding memory pressure events.
Monitoring Recommendations
- Ingest journalctl -u cockpit and system memory metrics into your SIEM for baseline and anomaly analysis.
- Rate-limit unauthenticated requests to the Cockpit login endpoint at a reverse proxy or web application firewall.
- Alert on repeated identical CockpitLang cookie values from a single client IP over short intervals.
How to Mitigate CVE-2026-76235
Immediate Actions Required
- Restrict network access to the Cockpit web interface (TCP 9090) using host firewalls or network segmentation so only trusted management networks can reach it.
- Apply vendor updates for cockpit-ws as soon as they are available from your Linux distribution.
- Place Cockpit behind an authenticating reverse proxy or VPN to remove unauthenticated exposure to the internet.
Patch Information
Refer to the Red Hat CVE-2026-76235 Advisory for fixed package versions and errata. Distribution maintainers ship the corrected cockpit-ws build through standard package channels; apply updates with dnf update cockpit-ws or the equivalent package manager command.
Workarounds
- Disable cockpit.socket on hosts that do not require the web management interface using systemctl disable --now cockpit.socket.
- Configure a reverse proxy in front of Cockpit to rate-limit unauthenticated requests and drop requests carrying suspicious CockpitLang cookie values.
- Bind Cockpit to loopback or a management VLAN only, and require SSH tunneling for administrative access.
# Configuration example: restrict Cockpit to a management network with firewalld
sudo firewall-cmd --permanent --zone=public --remove-service=cockpit
sudo firewall-cmd --permanent --new-zone=mgmt || true
sudo firewall-cmd --permanent --zone=mgmt --add-source=10.10.0.0/24
sudo firewall-cmd --permanent --zone=mgmt --add-service=cockpit
sudo firewall-cmd --reload
# Or disable the service entirely if unused
sudo systemctl disable --now cockpit.socket
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
