Hi,

The following vulnerability was published for cockpit.

CVE-2026-76235[0]:
| A memory leak flaw was found in cockpit-ws. The login page handler
| leaks a heap allocation on every unauthenticated request that
| carries a CockpitLang cookie, allowing a remote unauthenticated
| attacker to exhaust memory on the host and cause a denial of
| service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-76235
https://www.cve.org/CVERecord?id=CVE-2026-76235
[1] https://github.com/cockpit-project/cockpit/pull/23633

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
cockpit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144975@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Pitt <mpitt@debian.org> (supplier of updated cockpit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 21 Aug 2026 06:22:23 +0200
Source: cockpit
Architecture: source
Version: 366-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Closes: 1144975
Changes:
 cockpit (366-1) unstable; urgency=medium
 .
   * New upstream release:
     - Networkmanager: Don't activate new network connections by default
     - Networkmanager: Navigate to details page after creation
   * ws: Free "language" string also when it comes from the cookie.
     Patch backported from ustream main. [CVE-2026-76235] (Closes: #1144975)
Checksums-Sha1:
 2ff0b5a6f12cee3b936cf25dc4db0c1c9c22a149 3241 cockpit_366-1.dsc
 8a0e49b5b09543f67ceb4720d77747e4630a9355 39356548 cockpit_366.orig-node.tar.xz
 02fffc0e694e3ef0b2bf4a2fe56f7fd9471fb7dd 15908636 cockpit_366.orig.tar.xz
 7a478730f402b0052f03afb3bbcc5ff36229c38b 26512 cockpit_366-1.debian.tar.xz
 7dd30a0d332a463a826e69e1a0c74bacb064e50f 10335 cockpit_366-1_source.buildinfo
Checksums-Sha256:
 075ea48ad8ded13ae4b7e1e22e7c8e9198bfa1011b7300715195a2f8459aec91 3241 cockpit_366-1.dsc
 e45d9b76ce19e1cfad33dbda3c7ad9c22fa5a29cf94f0492fdab23b46511e093 39356548 cockpit_366.orig-node.tar.xz
 bf0a8c37eca303282a85777e049fce67fe2002743fabfb3e85f9de24855b099a 15908636 cockpit_366.orig.tar.xz
 447e178def2568d9b90d3a5c3e81be3e964289864de8e25020b3e047d906af25 26512 cockpit_366-1.debian.tar.xz
 2d7a912ddfcd963f1b213f503f3f7c5ecfe09a37f3e99abd6052d2b981242094 10335 cockpit_366-1_source.buildinfo
Files:
 795e497b18d6757acd714ba38c540980 3241 admin optional cockpit_366-1.dsc
 b4f834554ce4d6a2b137f28fc164d20f 39356548 admin optional cockpit_366.orig-node.tar.xz
 016d4a5b7fa14a452756dce319715215 15908636 admin optional cockpit_366.orig.tar.xz
 02ba28d1a1f95f3a625294aacc70a5ae 26512 admin optional cockpit_366-1.debian.tar.xz
 90dfc3da909cac7e8d439f8bf5550b76 10335 admin optional cockpit_366-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmqH0zYACgkQ7nvd5Lhr
VxODchAAoo/h7JxGURnBTcLZofTvuiRDC9UasN+MYGQF0sRjsPEGcTJvIYYCLDaM
GPRWKnIOCPOogui7ckTAIZ3nMfgfo+t4PnBduuaypsKyll+WCmjZGmBOwVND0uHG
GjCqcHobgUtsXCUtuQIVz4num0J7sNM10FkNiuEbwCxPnWwrFS6XYR2+EQXwu+R0
F94D9HnI3eaFI1rM8tz8I0l/9TIHCeHZx/n2VSWdAlpimzdx5ZfklXR/lTnSvJM6
o5vCoTiTJcbezz2lBMRP+zXfRsKfzCOrZJdmRcYyciyxMgyrUEncbs3p2Nfcc0TI
S8DFnFrSXbCHJ41olaLZYmeh9Gd+mzTem+BpdL+sVH/xm0r17Od358hbGmqv3fvf
Nzm0bCiInggt3MfQYwf5DD/SABgAkKM4u6POxFMqtsBjv5vOwvW5M+nXlVJ09JGF
aHKObSdH7uOCpEOnQ8463d4mwnL1yqUte8yMEX3iz05eZ65CslpdeTh8tfYEjXR1
NIrn+KRk9VhmA8GV+7N+i/cAaaAVd/pg5qoTPtr35LthYQ3xD1xK18mDGk3pAFXP
im18K9dGIvQhFx1RIBh8k2tc0Ln1xbwl8spdCNoU6t7sIb67k50LXHxHPIw3Sgyz
152g2zbflvoc+/EK5OX68atWQJ8e1eJCpFk68Zth3T0x5RoIhVo=
=XiPa
-----END PGP SIGNATURE-----

Buongiorno Salvatore,

Salvatore Bonaccorso [2026-08-21  6:07 +0200]:

I prepared a trixie security update, attached debdiff. Please let me know
if/when to upload.

Thanks!

Pitti