This vulnerability in Cockpit allows an unauthenticated remote attacker to initiate and sustain numerous simultaneous connections to the cockpit-tls service on TCP port 9090. This triggers the creation of an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The result is a denial of service (DoS) condition that degrades or completely disrupts the availability of the Cockpit service for legitimate users. The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The impact is strictly availability-related, with no confidentiality or integrity impact. The vulnerability has a CVSS v3.1 base score of 7.5 (medium severity).

The primary impact is denial of service through resource exhaustion caused by unbounded thread creation in the cockpit-tls service. This can lead to degradation or complete unavailability of the Cockpit service. Confidentiality and integrity are not affected. Exploitation requires network access to the Cockpit listener on TCP port 9090. There are no known exploits in the wild at this time.

Red Hat has published an advisory acknowledging this important denial-of-service flaw. The advisory does not explicitly state that a fix is currently available or provide patch links. Therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigation options may be limited. Network-level controls restricting access to TCP port 9090 could reduce exposure. Monitor Red Hat's advisory for updates on patches or official mitigations.