{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10-1.el8_10","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-91147","cwes":["CWE-617"],"description":"A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.","epss":{"date":"2026-11-03","percentile":0.34697,"score":0.00404},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479230"}],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793728382513,"publishedAt":1789749831546,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:94485"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-91147"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479230"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479230"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"A code fix is being pursued for the affected streams. Until updated packages are available, avoid configuring a non-empty [WebService] UrlRoot in cockpit-ws where feasible. If a non-empty UrlRoot is required, configure the front-end proxy or TLS terminator in front of cockpit-ws to rewrite or redirect requests for the exact configured prefix (for example, /cockpit) to the trailing-slash form (for example, /cockpit/) before forwarding them, so the exact-prefix request never reaches cockpit-ws unnormalized. Deployments whose front end already normalizes or redirects such requests are not exposed through that route."}],"revision":"ca16ae6c5ff0d6aaca105c282b104fa27deae0bb8edb047cef7959720bd49a92","sources":[{"modifiedAt":1793728382513,"name":"CNA: redhat","retrievedAt":1793729461564,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91147"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793729466742,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91147"}],"ssvc":{"assessedAt":1790094198184,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash","updatedAt":1793729466742}