COCKPIT · CVE-2026-91150 · Infrastructure
FIX → 372 ✓ verified
Cockpit, the web console for managing Linux servers, does not limit the total size of fragmented WebSocket messages it accepts. A remote attacker who sends crafted fragments without logging in can exhaust memory and take down the cockpit-ws service.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running the Cockpit web console (cockpit-ws) older than 372. The NVD text says the flaw is reachable without logging in, but the maintainer's fix commit calls it a post-authentication attack: fragments are accepted per message with no total limit, so memory grows in the cockpit-wsinstance user's process. Machines without Cockpit, or where port 9090 is limited to trusted admins, are much less exposed.
Not affected if auth-required, cockpit-not-installed, network-restricted
Who cares auth-required, cockpit, linux, self-hosted
Upgrade to 372
Upgrade Cockpit to 372 or later (release 372 lists CVE-2026-91150; fix commit 4bc66ac adds a limit on reassembled WebSocket message size in src/ws/websocketconnection.c).
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the cockpit-ws service.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.