Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Cockpit Update Fixes Resource-Consuming Crash and Slowdown
published 6 months ago
Summary
This update addresses two security issues in Cockpit, a system management tool, that could cause it to consume excessive resources and crash, or become very slow to respond. These issues are fixed to prevent data loss and system downtime. Update your Cockpit installation to the latest version to ensure you have the latest security patches.
What to do
- Update opensuse cockpit to version 354-160000.2.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | cockpit |
< 354-160000.2.1 Fix: upgrade to 354-160000.2.1
|
Original advisory text
Security update for cockpit
This update for cockpit fixes the following issues:
- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive resource consumption and crash
a Node.js process (bsc#1257836).
- CVE-2026-26996: minimatch: processing of glob pattern containing repeated wildcards followed by a literal character
that doesn't appear in the test string can lead to ReDoS (bsc#1258641).
- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive resource consumption and crash
a Node.js process (bsc#1257836).
- CVE-2026-26996: minimatch: processing of glob pattern containing repeated wildcards followed by a literal character
that doesn't appear in the test string can lead to ReDoS (bsc#1258641).
References
- https://bugzilla.suse.com/1257836 Third Party Advisory
- https://bugzilla.suse.com/1258641 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-25547 URL
- https://www.suse.com/security/cve/CVE-2026-26996 URL
Timeline
Published10 Apr 2026
Updated22 Apr 2026
First seen22 Apr 2026
Sources
openSUSE-SU-2026:20504-1 · OSV
Track software like this
Free during beta