This vulnerability in Cockpit allows an unauthenticated remote attacker to initiate and sustain many simultaneous connections to the cockpit-tls service on TCP port 9090. The service creates an unbounded number of detached threads in response, consuming system resources such as memory and file descriptors. This results in a denial of service by exhausting resources, making the Cockpit service unavailable or degraded for legitimate users. The flaw is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 7.5, reflecting high impact on availability with no impact on confidentiality or integrity. Red Hat is the authoritative source for this vulnerability, and the advisory is available at https://access.redhat.com/security/cve/CVE-2026-91149.

The primary impact is denial of service due to resource exhaustion caused by unbounded thread creation. This leads to degradation or complete unavailability of the Cockpit service on affected Red Hat Enterprise Linux 10 systems. There is no impact on confidentiality or integrity of the system or data.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-91149 for current remediation guidance. Until a fix is available, limiting network access to the Cockpit listener on TCP port 9090 can reduce exposure. Monitor Red Hat advisories for updates on patches or official mitigations.