Memory Leak Vulnerability in Cockpit Web Service by Red Hat
CVE-2026-76235
7.5HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 19 August 2026
What is CVE-2026-76235?
A memory leak vulnerability has been identified in Cockpit Web Service, where the login page handler inadvertently leaks heap allocations for each unauthenticated request that carries a CockpitLang cookie. This behavior can be exploited by a remote attacker, potentially leading to memory exhaustion on the host system. Such an exploit may result in a denial of service, impacting the availability of the service and degrading system performance. Users are advised to apply the latest updates to mitigate this issue.
Affected Version(s)
Red Hat Enterprise Linux 8 0:310.10-1.el8_10
Red Hat Enterprise Linux 9 0:356.4-1.el9_8
Red Hat Enterprise Linux 9 0:356.4-1.el9_8
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Arpit Jain for reporting this issue.