Cockpit is a web-based interface for administering GNU/Linux servers. A security update addresses multiple vulnerabilities including an unauthenticated remote memory leak via the CockpitLang cookie in the send_login_html function (CVE-2026-76235). This issue could allow an attacker to leak memory remotely without authentication. The update fixes this vulnerability in version 356.4-1.el9_8 and later.