CVE-2026-91147 — Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

Description (CNA)

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Enterprise Linux 10	affected
Red Hat / Red Hat Enterprise Linux 7	affected
Red Hat / Red Hat Enterprise Linux 8	affected
Red Hat / Red Hat Enterprise Linux 9	affected
Red Hat / Red Hat OpenShift Dev Spaces	affected
Red Hat / Red Hat OpenShift Dev Spaces	affected
Red Hat / Red Hat OpenShift Dev Spaces	affected

CWE

CWE-617

References

https://access.redhat.com/security/cve/CVE-2026-91147
https://bugzilla.redhat.com/show_bug.cgi?id=2479230

ADP enrichment

CISA-ADP

No English description supplied.

https://bugzilla.redhat.com/show_bug.cgi?id=2479230