Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Mageia Cockpit can leak memory to unauthenticated users
published 1 month ago
Summary
The Cockpit web management tool included in Mageia may let anyone send a specially crafted cookie and cause the server to waste memory, potentially slowing or crashing the service. This does not require a login, so an external attacker could disrupt the system. Install the latest Cockpit package updates from Mageia to stop the problem.
What to do
- Update mageia cockpit to version 356.2-1.1.mga10.
- Update mageia cockpit to version 356.2-1.1.mga9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Mageia:10 | mageia | cockpit |
< 356.2-1.1.mga10 Fix: upgrade to 356.2-1.1.mga10
|
| Mageia:9 | mageia | cockpit |
< 356.2-1.1.mga9 Fix: upgrade to 356.2-1.1.mga9
|
Original advisory text
Updated cockpit packages fix a security vulnerability
Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in
send_login_html. (CVE-2026-76235)
send_login_html. (CVE-2026-76235)
References
- https://advisories.mageia.org/MGASA-2026-0408.html Vendor Advisory
- https://bugs.mageia.org/show_bug.cgi?id=36207 Third Party Advisory
- https://lists.debian.org/debian-security-announce/2026/msg00385.html URL
- https://bugzilla.redhat.com/show_bug.cgi?id=2519497 Third Party Advisory
- https://github.com/cockpit-project/cockpit/pull/23633 URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
Timeline
Published16 Sep 2026
Updated16 Sep 2026
First seen16 Sep 2026
Sources
MGASA-2026-0408 · OSV
Track software like this
Free during beta