A flaw was found in cockpit-ws. The send_login_html() function in src/ws/cockpithandlers.c reads the CockpitLang cookie via cockpit_web_server_parse_cookie(), which returns a heap-allocated string (via g_uri_unescape_segment, transfer-full ownership). On this code path, the function's only cleanup call is g_strfreev(languages), but languages remains NULL when the value came from the cookie rather than the Accept-Language header, so the allocated 'language' string is never freed. Every unauthenticated GET request to the login page carrying a CockpitLang cookie leaks one heap allocation sized by the (attacker-controlled) decoded cookie value, up to Cockpit's ~8192-byte request-size cap. Sustained requests grow the shared cockpit-ws process's memory without bound, eventually causing it to be OOM-killed and disrupting all users of that instance, not just the attacker.

Candidate upstream fix (Martin Vollmer):
  if (languages)
    g_strfreev (languages);
  else
    g_free (language);