CVE-2026-91147

Published: Sep 18, 2026Modified: Sep 22, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (3)

https://access.redhat.com/security/cve/CVE-2026-91147

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2479230

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2479230

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.