Vulnerability · Published Sep 18, 2026 · Assigned by redhat
CVE-2026-91149Cockpit: cockpit: denial of service via unbounded connection thread spawning
High 7.5
In plain English
A high-severity resource allocation without limits in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | cockpit | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-bridge | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-doc | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-packagekit | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-storaged | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-system | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-ws | 356.4-1.el9_8 | ALSA-2026:94533 |
| AlmaLinux:9 | cockpit-ws-selinux | 356.4-1.el9_8 | ALSA-2026:94533 |
| Debian:12 | cockpit | no fix listed | DEBIAN-CVE-2026-91149 |
| Debian:13 | cockpit | no fix listed | DEBIAN-CVE-2026-91149 |
| Debian:14 | cockpit | 368-1 | DEBIAN-CVE-2026-91149 |
| Rocky Linux:9 | cockpit | 0:356.4-1.el9_8.rocky.0.1 | RLSA-2026:94533 |
| Ubuntu:22.04:LTS | cockpit | no fix listed | UBUNTU-CVE-2026-91149 |
| Ubuntu:24.04:LTS | cockpit | no fix listed | UBUNTU-CVE-2026-91149 |
| Ubuntu:26.04:LTS | cockpit | no fix listed | UBUNTU-CVE-2026-91149 |
| Ubuntu:26.10 | cockpit | no fix listed | UBUNTU-CVE-2026-91149 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat OpenShift Dev Spaces | see references |
| Red Hat | Red Hat OpenShift Dev Spaces | see references |
| Red Hat | Red Hat OpenShift Dev Spaces | see references |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2026:94533 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-91149 vdb-entry, x_refsource_REDHAT
- RHBZ#2479422 issue-tracking, x_refsource_REDHAT