CVE-2026-91150
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.