Memory Leak in Cockpit-WS via Unauthenticated Requests

Executive Summary

CVE-2026-76235 is a memory leak flaw in cockpit-ws, the web service for the Cockpit management interface. When unauthenticated requests include a CockpitLang cookie, the login page handler leaks heap memory. The issue occurs because the cleanup process fails to free allocated memory for the cookie value, causing memory exhaustion over time.

Useful 0 Not Useful 0

Detection Guidance

Monitor cockpit-ws memory usage for gradual increases over time, especially after handling login page requests with CockpitLang cookies. Check system logs for out-of-memory (OOM) events or cockpit-ws crashes. Use tools like 'top', 'htop', or 'ps' to observe memory consumption of the cockpit-ws process. Look for repeated GET requests to the login page with the CockpitLang cookie in web server access logs.

• Check cockpit-ws memory usage: ps aux | grep cockpit-ws or top -p $(pgrep cockpit-ws)
• Monitor logs: journalctl -u cockpit-ws --no-pager | grep -i 'memory leak' or 'OOM'
• Inspect web server logs: grep 'GET /login' /var/log/nginx/access.log or similar for repeated requests with CockpitLang cookie

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to send repeated requests with a CockpitLang cookie, causing the cockpit-ws process to consume excessive memory. This can lead to an out-of-memory condition, disrupting all users of the affected system by making the service unavailable.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to the cockpit port immediately to limit exposure. Temporarily block or filter requests containing the CockpitLang cookie at the firewall or web server level. Update cockpit-ws to the latest patched version once available. If patching is not possible, consider disabling cockpit-ws until a fix is applied to prevent potential DoS attacks.

• Restrict cockpit port access: firewall-cmd --add-rich-rule='rule family="ipv4" port port="9090" protocol="tcp" reject' or use iptables
• Block CockpitLang cookie requests: Configure web server (e.g., Nginx) to drop requests with 'CockpitLang' in headers or cookies
• Monitor and restart: Set up alerts for cockpit-ws memory spikes and ensure systemd auto-restart is enabled

Useful 0 Not Useful 0