DEBIAN-CVE-2026-91149
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-91149
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91149.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-91149
- Upstream
- Published
- 2026-09-18T17:17:05Z
- Modified
- 2026-09-19T07:00:10Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the
cockpit-tlsservice. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users. - References
Affected packages
Debian:12 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
Other
287-1
289-1
290-1
291-1
292-1
293-1
294-1
295-1
296-1
297-1~bpo12+1
297-1
298-1
299-1~bpo12+1
299-1
300-1
301-1~bpo12+1
301-1
302-1
303-1~bpo12+1
303-1
304-1
305-1~bpo12+1
305-1
306-1~bpo12+1
306-1
307-1~bpo12+1
307-1
308-1~bpo12+1
308-1
309-1~bpo12+1
309-1
310-1
311-1~bpo12+1
311-1
312-1
313-1
314-1
316-1
317-1
317-2
317-3
317-4
317-5
318-1
318-2
318-3
318-4~bpo12+1
318-4
319-1~bpo12+1
319-1
320-1~bpo12+1
320-1
321-1
322-1~bpo12+1
322-1
323-1~bpo12+1
323-1
324-1~bpo12+1
324-1
325-1~bpo12+1
325-1
326-1
327-1~bpo12+1
327-1
328-1
329-1~bpo12+1
329-1
330-1
330-2
330-3
330-4
331-1~bpo12+1
331-1
332-1
333-1~bpo12+1
333-1
334-1
335-1
335-2~bpo12+1
335-2
336-1
337-1~bpo12+1
337-1
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
360-1
362-1~bpo13+1
362-1
365-1~bpo13+1
365-1
366-1~bpo13+1
366-1
367-1~bpo13+1
367-1
287.*
287.1-0+deb12u1
287.1-0+deb12u2
287.1-0+deb12u3
288.*
288.1-1
294.*
294.1-1
300.*
300.1-1~bpo12+1
300.1-1
310.*
310.1-1~bpo12+1
310.1-1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1
Debian:13 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
Other
337-1
337-1+deb13u1
337-1+deb13u2
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
360-1
362-1~bpo13+1
362-1
365-1~bpo13+1
365-1
366-1~bpo13+1
366-1
367-1~bpo13+1
367-1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1
Debian:14 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
Other
337-1
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
360-1
362-1~bpo13+1
362-1
365-1~bpo13+1
365-1
366-1~bpo13+1
366-1
367-1~bpo13+1
367-1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1