---
id: "CVE-2026-91150"
page: "https://infrastack.ai/live/CVE-2026-91150"
kind: "vulnerability"
aliases: ["CVE-2026-91150"]
title: "Cockpit: fragmented WebSocket messages exhaust memory and crash cockpit-ws"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "cockpit", "fixed": ["372"], "affected": "< 372 (first affected version unknown)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "cockpit", "infrastructure", "linux", "self-hosted"]
not_affected_if: ["auth-required", "cockpit-not-installed", "network-restricted"]
published_at: "2026-11-11T19:17:47+00:00"
first_seen_at: "2026-11-11T19:28:48+00:00"
updated_at: "2026-11-11T19:31:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91150", "first_seen_at": "2026-11-11T19:28:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T19:31:56+00:00"}]
exploit_sources: []
---

# Cockpit: fragmented WebSocket messages exhaust memory and crash cockpit-ws

Link for people: https://infrastack.ai/live/CVE-2026-91150 (this .md is for agents)

Cockpit, the web console for managing Linux servers, does not limit the total size of fragmented WebSocket messages it accepts. A remote attacker who sends crafted fragments without logging in can exhaust memory and take down the cockpit-ws service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:cockpit affected < 372 (first affected version unknown) fixed 372

## How to check

- Run cockpit-ws --version, or rpm -q cockpit / dpkg -l cockpit. Versions below 372 lack the fix. Distros may backport, so check your distro's advisory for CVE-2026-91150.
- Check whether port 9090 is reachable from untrusted networks (ss -ltn | grep 9090; firewall rules). If Cockpit is not needed, systemctl disable --now cockpit.socket.

## Fix

Upgrade Cockpit to 372 or later (release 372 lists CVE-2026-91150; fix commit 4bc66ac adds a limit on reassembled WebSocket message size in src/ws/websocketconnection.c).

## Timeline

- 2026-11-11T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91150
- 2026-11-11T19:31:56+00:00 analyst — Fix = Cockpit 372 per release notes and commit 4bc66ac. Commit message says post-authentication, minor issue, contradicting NVD 'without authentication'; flagged in who_affected. Lower bound of affected versions not stated in sources. No exploitation or PoC checked beyond vendor pages.

## Documents

- [fix] Patch: github.com https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93
- [fix] Release notes: github.com https://github.com/cockpit-project/cockpit/releases/tag/372

## From the sources

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_