A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61b2a3477a advisory.

    Automatic update for cockpit-368-1.fc44.

    ##### **Changelog for cockpit**

    ```
    * Wed Sep 23 2026 Packit <hello@packit.dev> - 368-1
    - Limit concurrent connections CVE-2026-91149
    - Harden cockpit-ws against trailing slash CVE-2026-91147
    - Sanitize URLs from PackageKit CVE-2026-91148
    - Interactive file chooser for SSH keys
    - Bug fixes and translation updates
    - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for rhel-10.4
    - Resolves RHEL-263066 for rhel-9.10

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the cockpit-368-1.el9 build changelog.

  - A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by     initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the     service to create an unbounded number of detached threads, consuming system resources such as memory and     file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete     unavailability of the Cockpit service for legitimate users. (CVE-2026-91149)

  - Automatic update for cockpit-368-1.fc45.  ##### **Changelog for cockpit**  ``` * Wed Sep 23 2026 Packit     <hello@packit.dev> - 368-1 - Limit concurrent connections CVE-2026-91149 - Harden cockpit-ws against     trailing slash CVE-2026-91147 - Sanitize URLs from PackageKit CVE-2026-91148 - Interactive file chooser     for SSH keys - Bug fixes and translation updates - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for     rhel-10.4 - Resolves RHEL-263066 for rhel-9.10  ```  (CVE-2026-91148)

  - A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a     Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is     configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can     terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
    (CVE-2026-91147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d375ea9e79 advisory.

    Automatic update for cockpit-368-1.fc45.

    ##### **Changelog for cockpit**

    ```
    * Wed Sep 23 2026 Packit <hello@packit.dev> - 368-1
    - Limit concurrent connections CVE-2026-91149
    - Harden cockpit-ws against trailing slash CVE-2026-91147
    - Sanitize URLs from PackageKit CVE-2026-91148
    - Interactive file chooser for SSH keys
    - Bug fixes and translation updates
    - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for rhel-10.4
    - Resolves RHEL-263066 for rhel-9.10

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a     Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is     configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can     terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
    (CVE-2026-91147)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363798	Fedora 44 : cockpit (2026-61b2a3477a)	Nessus	Fedora Local Security Checks	Local	high
363460	CentOS 9 : cockpit-368-1.el9	Nessus	CentOS Local Security Checks	Local	high
349923	Fedora 45 : cockpit (2026-d375ea9e79)	Nessus	Fedora Local Security Checks	Local	high
348262	Linux Distros Unpatched Vulnerability : CVE-2026-91147	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-91147

medium

Tenable Plugins

high

high

high

medium