CVE Catalog
CVE-2026-76235
HighCVSS 7.5Summary
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
Risk Assessment
An attacker can exhaust memory and cause service outage, making the system unavailable to legitimate users.
Recommendation
Apply the vendor patch that fixes the memory leak, and consider restricting access to the login interface.
Original NVD description (English source)
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.