CVE-2026-76235

Published: Aug 19, 2026Modified: Aug 25, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (2)

https://access.redhat.com/security/cve/CVE-2026-76235

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2519497

Source: secalert@redhat.com

Timeline

No history available yet.