This vulnerability in cockpit-ws allows a remote unauthenticated attacker to cause a denial of service by sending a specially crafted request to the configured WebService.UrlRoot without a trailing slash. The flaw triggers a reachable assertion that causes cockpit-ws to terminate unexpectedly, resulting in service unavailability. Exploitation requires a non-default UrlRoot configuration and direct access to cockpit-ws without intermediary normalization or redirection. The CVSS v3.1 base score is 5.9 (medium severity) with a high attack complexity and no impact on confidentiality or integrity.

Successful exploitation results in denial of service by crashing the cockpit-ws service, making the Cockpit web interface unavailable. There is no confidentiality or integrity impact. The attack requires specific configuration and network conditions, limiting exploitability in typical Red Hat Enterprise Linux 10 deployments.

No explicit patch or fix is currently confirmed in the vendor advisory. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-91147 for current remediation guidance. Exploitation requires a non-default UrlRoot configuration and direct access to cockpit-ws without front-end normalization or redirection, so typical default deployments are less vulnerable. Monitor the vendor advisory for updates on fixes or mitigations.