[ALSA-2026:94533] Important: cockpit security update
Type:
security
Severity:
important
Release date:
2026-11-04
Description:
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147) * cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149) * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 cockpit-ws-356.4-1.el9_8.aarch64.rpm 0383a2c31206b7c4b72a7e6795b514753a7c9c79d476257fa5662fe6ef1a5f8b
aarch64 cockpit-ws-selinux-356.4-1.el9_8.aarch64.rpm b70b7ff9faf062a9f3c2a092372d87052fa2cbeef3ac6b2245c47a8b63a7493a
aarch64 cockpit-356.4-1.el9_8.aarch64.rpm d2fba3ea7114ee802c313af7f5a4963e7716dda41d45a2671c34a09cb1728cb6
noarch cockpit-storaged-356.4-1.el9_8.noarch.rpm 45895ef4d132e0966b6d96a1fd282f427f16df53775bb19e5e46af9bf1f397a3
noarch cockpit-system-356.4-1.el9_8.noarch.rpm 55c33fbaa81d442e1880fb958a0e1f954549638b8e7424313d004c71d058170c
noarch cockpit-doc-356.4-1.el9_8.noarch.rpm b182e122607802cfa0c3580fedc9306d50f06915b485c9762567562829fa6c29
noarch cockpit-packagekit-356.4-1.el9_8.noarch.rpm c82efbfcd2cbbec8e08b935862a376ff62335b91b7973da3bb165ba75c2368bb
noarch cockpit-bridge-356.4-1.el9_8.noarch.rpm ee4fd632a0241fd946707cfd2062271edc046e80a0e110d4a24640f048b757a4
ppc64le cockpit-356.4-1.el9_8.ppc64le.rpm 70185be13ace9e8b70c4910a69e2f1aabe96df8f3e16f64f4da708e9c402eb87
ppc64le cockpit-ws-selinux-356.4-1.el9_8.ppc64le.rpm aef97e46392218a5d91fe15528c15bb9756383f894fb72b92e8e70a087fc9fa6
ppc64le cockpit-ws-356.4-1.el9_8.ppc64le.rpm d58b0d3d676d5dd3e522836f5f73e16ea2c5bec9d93cddde495bd50f1a3cfc76
s390x cockpit-ws-356.4-1.el9_8.s390x.rpm 3adb8d4305f414c355b45d37cbf6bce3dc181360ca09cdd9a4365b440aefb1da
s390x cockpit-356.4-1.el9_8.s390x.rpm 912544b4367c4451b6ec22deb661a40dd61649ce5a007efbb657c1a576f24813
s390x cockpit-ws-selinux-356.4-1.el9_8.s390x.rpm b7610f44c5f845a30151ffeff4b99f4d88e01739bd05fcb025369a9ee427893f
x86_64 cockpit-ws-selinux-356.4-1.el9_8.x86_64.rpm 83cbf728fedf83095bb1b1fd4c601ae9e263dc8434f71e2d3dfa2dbe1888c2f6
x86_64 cockpit-ws-356.4-1.el9_8.x86_64.rpm ad5c14aca19ba5567dd2cc6c335edcc10ce07a17a177d50cea9c46cb552a1053
x86_64 cockpit-356.4-1.el9_8.x86_64.rpm c77fe47998ec28bf49bcb796334a72fe12ecb32f1b14e6b2f9f8ca90397c00a1
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.