CVE-2026-76235
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
Risk Assessment
An attacker can exhaust memory and cause service outage, making the system unavailable to legitimate users.
Recommendation
Apply the vendor patch that fixes the memory leak, and consider restricting access to the login interface.
Other vulnerabilities in cockpit-ws
Original NVD description (English source)
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS