This vulnerability involves a memory leak in the cockpit-ws login page handler that leaks heap allocations on every unauthenticated request with a CockpitLang cookie. This leak can be exploited remotely without authentication to exhaust host memory and cause a denial of service. The component is stateless, and its crash or restart does not compromise host confidentiality or integrity. The process is automatically restarted by systemd. Red Hat classifies the impact as Moderate and advises restricting access to trusted clients until a patch is released.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by exhausting memory on the host via repeated unauthenticated requests. However, since cockpit-ws is stateless and automatically restarted, the impact is limited to availability and does not affect confidentiality or integrity of the host or other services.

Red Hat advises restricting network access to the cockpit port to trusted clients until an official fix is available. There is no configuration-level mitigation that fully removes the flaw because the login page must remain accessible without authentication. Monitor Red Hat's advisory for patch availability.