Cockpit: Denial of service via unbounded fragmented WebSocket messages
Summary
A flaw in the cockpit-ws web service of Cockpit, the browser-based Linux administration interface, allows an unauthenticated remote attacker to send specially crafted fragmented WebSocket messages. The fragments accumulate without a total size limit, so memory use grows until the service is exhausted. This makes Cockpit unavailable, and the risk is highest where the Cockpit port is reachable from the internet.
Affected
- Red Hat Enterprise Linux 7, 8, 9 and 10 (Cockpit, all versions marked as affected by the CNA)
- Red Hat OpenShift Dev Spaces
- Upstream Cockpit releases before 372 (inferred, not explicitly confirmed)
Fixed in
- Upstream Cockpit 372 (fix commit 4bc66ac3e5b4923528f1ac89517a009b7bc90f93)
- Red Hat and distribution fixed package versions: Unknown.
Workaround
- Restrict network access to the Cockpit port (cockpit-ws) with a firewall or VPN-only access.
- Disable cockpit-ws if Cockpit is not needed.
Exploitation
- No exploitation in the wild is known at the time of publication.
- No public proof of concept or exploit code is known at the time of publication.
Our recommendation
- Check whether Cockpit is installed and running on any host, and whether its port is reachable from the internet.
- Restrict access to Cockpit immediately if it is exposed, and disable it if it is not used.
- Apply the vendor update as soon as Red Hat or your distribution lists a fixed version, and confirm the version against the vendor advisory.
- Patch the related Cockpit CVEs (CVE-2026-91147, CVE-2026-91149, CVE-2026-91151) together.
- Re-check the Red Hat CVE page and NVD over the next few days for fixed-version data and exploitation reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-91150 access.redhat.com
- Red Hat Bugzilla 2478436 bugzilla.redhat.com
- Cockpit fix commit 4bc66ac github.com
- Cockpit release 372 github.com
- CVE Program record CVE-2026-91150 www.cve.org
- Cockpit pull request 23921 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:33.
Original description (NVD)
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.
NVD references (9)
- https://access.redhat.com/errata/RHSA-2026:99599
- https://access.redhat.com/errata/RHSA-2026:99600
- https://access.redhat.com/errata/RHSA-2026:99601
- https://access.redhat.com/errata/RHSA-2026:99602
- https://access.redhat.com/errata/RHSA-2026:99603
- https://access.redhat.com/security/cve/CVE-2026-91150
- https://bugzilla.redhat.com/show_bug.cgi?id=2478436
- https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93
- https://github.com/cockpit-project/cockpit/releases/tag/372
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.