CVE-2026-91150

CVSS 7.5 (high) · published 2026-11-11

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.

Weakness: CWE-770

Source: NVD CVE-2026-91150

References

• https://access.redhat.com/errata/RHSA-2026:99599
• https://access.redhat.com/errata/RHSA-2026:99600
• https://access.redhat.com/errata/RHSA-2026:99601
• https://access.redhat.com/errata/RHSA-2026:99602
• https://access.redhat.com/errata/RHSA-2026:99603
• https://access.redhat.com/security/cve/CVE-2026-91150
• https://bugzilla.redhat.com/show_bug.cgi?id=2478436
• https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93
• https://github.com/cockpit-project/cockpit/releases/tag/372

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.