CVE-2026-91149 in Red Hat
Summary
by MITRE • 09/18/2026
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Cockpit management interface represents a significant resource exhaustion flaw that allows an unauthenticated remote attacker to disrupt system availability through a classic Denial of Service attack vector. This specific weakness stems from how the cockpit-tls service handles incoming network connections, particularly when subjected to high concurrency without proper authentication or rate limiting mechanisms. By initiating and sustaining numerous simultaneous connections, an adversary can trigger the creation of detached threads for each connection attempt. Unlike standard thread pools that might reuse existing resources or enforce limits on active sessions, this implementation fails to cap the number of concurrent detached threads spawned by the service. As a result, every new connection consumes additional memory and file descriptors without being properly cleaned up or restricted, leading to an unbounded growth in resource consumption.
From a technical perspective, this flaw aligns with CWE-787: Out-of-bounds Write if viewed through the lens of memory corruption risks, but more accurately maps to CWE-400: Uncontrolled Resource Consumption and CWE-295: Improper Certificate Validation or Authentication Bypass when considering the unauthenticated nature of the attack. The core issue lies in the lack of connection throttling or maximum session limits within the cockpit-tls daemon. When an attacker floods the service with persistent connections, the operating system's kernel eventually runs out of available file descriptors and memory pages allocated to the process. This exhaustion prevents the creation of new threads for legitimate administrative tasks, effectively freezing the management interface. The attack does not require any prior authentication credentials, making it particularly dangerous as it can be executed by any remote actor with network access to the service port.
The operational impact of this vulnerability is severe, resulting in a complete denial of service for system administrators and automated tools relying on Cockpit for server management. Legitimate users attempting to connect will experience timeouts or immediate disconnections because the service lacks the resources to process new requests. In critical infrastructure environments where Cockpit is used for monitoring and controlling servers, this outage can lead to significant operational downtime, hinder incident response efforts, and potentially mask other malicious activities occurring on the system during the period of unavailability. The degradation may also cause instability in dependent services that rely on the underlying operating system's stability under resource pressure.
To mitigate this vulnerability, immediate remediation should focus on applying vendor-provided patches that address the thread management logic within cockpit-tls. Administrators without access to updates can implement network-level controls such as firewall rules or reverse proxy configurations to limit the rate of incoming connections from untrusted IP addresses. Utilizing tools like fail2ban or nginx connection limits can help enforce maximum concurrent session counts, preventing a single source from exhausting system resources. Additionally, restricting access to Cockpit via SSH tunneling or VPN ensures that only authenticated and authorized users can reach the service port, thereby eliminating the attack surface for unauthenticated remote exploitation until a permanent software fix is deployed.