{"id":"CVE-2026-91150","kind":"vulnerability","aliases":["CVE-2026-91150"],"related":[],"title":"Cockpit: fragmented WebSocket messages exhaust memory and crash cockpit-ws","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.","summary":"Cockpit, the web console for managing Linux servers, does not limit the total size of fragmented WebSocket messages it accepts. A remote attacker who sends crafted fragments without logging in can exhaust memory and take down the cockpit-ws service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cockpit","fixed":["372"],"affected":"< 372 (first affected version unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","cockpit","infrastructure","linux","self-hosted"],"not_affected_if":["auth-required","cockpit-not-installed","network-restricted"],"how_to_check":"- Run cockpit-ws --version, or rpm -q cockpit / dpkg -l cockpit. Versions below 372 lack the fix. Distros may backport, so check your distro's advisory for CVE-2026-91150.\n- Check whether port 9090 is reachable from untrusted networks (ss -ltn | grep 9090; firewall rules). If Cockpit is not needed, systemctl disable --now cockpit.socket.","fix":"Upgrade Cockpit to 372 or later (release 372 lists CVE-2026-91150; fix commit 4bc66ac adds a limit on reassembled WebSocket message size in src/ws/websocketconnection.c).","status":"open","published_at":"2026-11-11T19:17:47+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:30:04+00:00","updated_at":"2026-11-11T19:31:56+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-11T19:30:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cockpit: fragmented WebSocket messages exhaust memory and crash cockpit-ws","impact":"low","summary":"Cockpit, the web console for managing Linux servers, does not limit the total size of fragmented WebSocket messages it accepts. A remote attacker who sends crafted fragments without logging in can exhaust memory and take down the cockpit-ws service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cockpit","linux","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker crashes the cockpit-ws service through memory exhaustion","analyst_note":"Find the affected and fixed Cockpit versions from the linked patch and release notes on github.com, and confirm whether the flaw is reachable before authentication.","how_to_check":"- Check the installed Cockpit version with `cockpit-ws --version` or `rpm -q cockpit` / `dpkg -l cockpit`, and compare it with the fixed version in the vendor release notes.\n- Check whether the Cockpit web service is reachable from untrusted networks on port 9090.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cockpit-not-installed","network-restricted"],"who_is_affected":"Any server running the Cockpit web console (cockpit-ws) that accepts connections from a network the attacker can reach. Machines where Cockpit is not installed, or where its port is limited to trusted administrator networks, are much less exposed. The sources do not list affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4553,"output_tokens":598,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Cockpit versions from the linked patch and release notes on github.com, and confirm whether the flaw is reachable before authentication.","search":"'-2026':13A,16A '-91150':14A,17A 'accept':47B 'accumul':93C 'allow':77C 'attack':50B,80C 'auth':20B 'auth-requir':19B 'authent':83C 'cockpit':1A,10A,18A,22B,28B,66B,74C,113C 'cockpit-w':9A,65B,112C 'consol':31B 'craft':53B,87C 'crash':8A 'cve':12A,15A 'denial':107C 'exhaust':5A,59B,104C 'flaw':70C 'found':72C 'fragment':2A,43B,54B,88C 'host':27B 'infrastructur':23B 'lead':100C 'limit':38B,99C 'linux':24B,34B 'log':56B 'manag':33B 'memori':6A,60B,103C 'messag':4A,45B,90C,92C 'prior':82C 'remot':49B,79C 'requir':21B 'self':26B 'self-host':25B 'send':52B,85C 'server':35B 'servic':68B,109C,115C 'size':41B,98C 'special':86C 'take':62B 'total':40B,97C 'total-s':96C 'unbound':102C 'vulner':76C 'web':30B 'websocket':3A,44B,89C 'without':55B,81C,94C 'ws':11A,67B,114C","nicknames":[],"mitigations":[],"who_affected":"Servers running the Cockpit web console (cockpit-ws) older than 372. The NVD text says the flaw is reachable without logging in, but the maintainer's fix commit calls it a post-authentication attack: fragments are accepted per message with no total limit, so memory grows in the cockpit-wsinstance user's process. Machines without Cockpit, or where port 9090 is limited to trusted admins, are much less exposed.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:31:56Z","by":"analyst","doc":"https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93","run_id":3584}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cockpit"],"ptokens":["cockpit"],"labels":["authrequired","cockpit","high","infrastructure","linux","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-91150':14A,17A 'cockpit':1A,10A,18A 'cockpit-w':9A 'crash':8A 'cve':12A,15A 'exhaust':5A 'fragment':2A 'memori':6A 'messag':4A 'websocket':3A 'ws':11A","search_b":"'accept':47B 'attack':50B 'auth':20B 'auth-requir':19B 'cockpit':22B,28B,66B 'cockpit-w':65B 'consol':31B 'craft':53B 'exhaust':59B 'fragment':43B,54B 'host':27B 'infrastructur':23B 'limit':38B 'linux':24B,34B 'log':56B 'manag':33B 'memori':60B 'messag':45B 'remot':49B 'requir':21B 'self':26B 'self-host':25B 'send':52B 'server':35B 'servic':68B 'size':41B 'take':62B 'total':40B 'web':30B 'websocket':44B 'without':55B 'ws':67B","search_c":"'accumul':93C 'allow':77C 'attack':80C 'authent':83C 'cockpit':74C,113C 'cockpit-w':112C 'craft':87C 'denial':107C 'exhaust':104C 'flaw':70C 'found':72C 'fragment':88C 'lead':100C 'limit':99C 'memori':103C 'messag':90C,92C 'prior':82C 'remot':79C 'send':85C 'servic':109C,115C 'size':98C 'special':86C 'total':97C 'total-s':96C 'unbound':102C 'vulner':76C 'websocket':89C 'without':81C,94C 'ws':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91150","severity":null,"published_at":"2026-11-11T19:17:47+00:00","modified_at":"2026-11-11T19:17:47+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91150:3584","url":null,"severity":null,"published_at":"2026-11-11T19:31:56+00:00","modified_at":"2026-11-11T19:31:56+00:00","first_seen_at":"2026-11-11T19:31:56+00:00","fetched_at":"2026-11-11T19:31:56+00:00","note":"Fix = Cockpit 372 per release notes and commit 4bc66ac. Commit message says post-authentication, minor issue, contradicting NVD 'without authentication'; flagged in who_affected. Lower bound of affected versions not stated in sources. No exploitation or PoC checked beyond vendor pages."}],"documents":[{"id":128168,"url":"https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128169,"url":"https://github.com/cockpit-project/cockpit/releases/tag/372","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}