Executive brief
Cockpit is a system administration interface for Linux servers. An unauthenticated attacker on the network can crash or disable Cockpit by opening many simultaneous connections, forcing the service to spawn unlimited threads that exhaust system memory and file descriptors. This leaves the server unavailable to legitimate administrators.
Technical details
The cockpit-tls service does not limit concurrent connections, allowing remote attackers to spawn unbounded detached threads via network access to TCP port 9090. An attacker can exhaust system resources (memory and file descriptors) without authentication or user interaction, triggering a denial of service. The vulnerability is in resource allocation without throttling (CWE-770).
Affected products
- Red Hat Cockpit <UNKNOWN>
Timeline
- 2026-09-18: disclosed