Description

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T13:18:11.637Z",
  "pubdate": "2026-08-19T13:18:11.637Z",
  "executiveSummary": "A memory leak vulnerability exists within cockpit-ws, specifically in the login page handler component, posing a significant risk to system availability. The flaw allows a remote, unauthenticated attacker to induce a denial of service (DoS) condition on the host system through repeated resource exhaustion.\nThe vulnerability stems from improper memory management during the processing of HTTP requests. When an unauthenticated request is transmitted to the server containing a specific CockpitLang cookie, the application allocates heap memory that is subsequently leaked and never reclaimed.\nBecause the vulnerability requires no authentication or special privileges, any external adversary with network access to the cockpit-ws service can systematically trigger heap memory allocation. By automating a high volume of malformed or targeted unauthenticated requests carrying the CockpitLang cookie, an attacker can rapidly consume all available system memory.\nThis leads to severe operational instability, potential out-of-memory (OOM) killer invocations terminating critical system processes, and an ultimate denial of service for legitimate users attempting to interact with the affected product. Mitigation requires applying official vendor patches or updates to resolve the underlying heap allocation leak in the login page handler.",
  "technicalDetails": "The vulnerability is characterized by a heap-based memory leak located in the login page handler of the cockpit-ws service. The root cause originates from inadequate lifecycle management of dynamically allocated heap buffers when handling incoming HTTP requests.\nSpecifically, the vulnerable component processes incoming HTTP headers and parses cookies to determine interface localization preferences. When an unauthenticated request arrives carrying the CockpitLang cookie, the application logic initiates a heap allocation to store or process the language parameter value. However, due to a flaw in the execution path of the unauthenticated request handler, the reference to this allocated memory is lost or omitted from the garbage collection or manual deallocation routines before the request context is destroyed.\nThe attack flow proceeds as follows: 1. The remote attacker crafts an HTTP request directed at the cockpit-ws login endpoint. 2. The attacker injects the CockpitLang cookie into the request headers. 3. The request is transmitted over the network to the target without requiring any prior authentication session or cryptographic tokens. 4. The login page handler parses the request, encounters the CockpitLang cookie, and triggers the faulty code path leading to an unmanaged heap allocation. 5. Upon completing or terminating the request processing lifecycle, the allocated memory is abandoned rather than freed, leaking the assigned heap space.\nBecause network exposure is inherent to the cockpit-ws administrative interface, this vector is accessible remotely. The attacker capabilities are limited to unauthenticated network access, yet this is sufficient to execute the payload repeatedly in a rapid-fire loop. By scripting concurrent requests containing the triggering cookie, the attacker forces the cumulative heap memory consumption to scale linearly with the request rate. Over time, this exhausts the available system RAM and swap space, resulting in host destabilization, application crashes, and denial of service across dependent services."
}