CVE-2026-91150

Name of the Vulnerable Software and Affected Versions Cockpit versions prior to 372

Description A flaw in the cockpit-ws service allows a remote attacker to cause a denial of service through memory exhaustion. The service limits individual WebSocket fragments to 128 KiB but fails to enforce a total size limit for reassembled messages. By sending specially crafted fragmented WebSocket messages, an attacker can cause these fragments to accumulate in memory without bound, leading to the crash of the web console.

Recommendations Upgrade to version 372. Restrict access to port 9090 to trusted networks.