CVE-2026-76235 is a memory leak flaw in the cockpit-ws login page handler. Each unauthenticated request with a CockpitLang cookie causes a heap allocation leak, enabling a remote unauthenticated attacker to exhaust system memory and cause a denial of service. The affected component is stateless and automatically restarted on failure, limiting impact to availability without affecting confidentiality or integrity. Red Hat classifies the issue as Moderate impact despite a CVSS score of 7.5, consistent with prior similar vulnerabilities. No patch is currently available, and mitigation involves restricting network access to trusted clients.

The vulnerability allows remote unauthenticated attackers to cause denial of service by exhausting memory on the host running cockpit-ws. However, since cockpit-ws is a stateless web console component, its crash or restart does not compromise confidentiality or integrity of the host or other services. The process is automatically restarted by systemd, limiting the impact to availability only.

Red Hat advises restricting network access to the cockpit port to trusted clients until a fix is available. There is no configuration-level mitigation that fully removes the flaw because the login page must remain accessible without authentication. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.