ALSA-2026:94533
- Source
- https://errata.almalinux.org/9/ALSA-2026-94533.html
- Import Source
- https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:94533.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALSA-2026:94533
- Upstream
CVE (3)
- CVE-2026-76235
- CVE-2026-91147
- CVE-2026-91149
- Related
- Published
- 2026-11-03T00:00:00Z
- Modified
- 2026-11-04T16:45:02Z
- Summary
- Important: cockpit security update
- Details
-
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
- cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147) - cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
- cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- cockpit: Cockpit: Denial of Service in
- References
-
- https://access.redhat.com/errata/RHSA-2026:94533
- https://access.redhat.com/security/cve/CVE-2026-76235
- https://access.redhat.com/security/cve/CVE-2026-91147
- https://access.redhat.com/security/cve/CVE-2026-91149
- https://bugzilla.redhat.com/2479230
- https://bugzilla.redhat.com/2479422
- https://bugzilla.redhat.com/2519497
- https://errata.almalinux.org/9/ALSA-2026-94533.html