CVE-2026-25577

Awaiting Analysis Awaiting Analysis - Queue

CookieError Handling Flaw in Emmett Request Causes DoS

Publication date: 2026-02-10

Last updated on: 2026-02-11

Assigner: GitHub, Inc.

Description

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-10

Last Modified

2026-02-11

Generated

2026-07-06

AI Q&A

2026-02-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25577

EUVD

EUVD-2026-7049

Affected Vendors & Products

Vendor	Product	Version / Range
emmett	emmett	to 1.3.11 (inc)
emmett	emmett-core	to 1.3.11 (exc)
emmett	emmett-core	to 1.3.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Emmett framework versions prior to 1.3.11. Specifically, the cookies property in mmett_core.http.wrappers.Request does not properly handle CookieError exceptions when parsing malformed Cookie headers. Because of this, unauthenticated attackers can cause the application to throw HTTP 500 errors, leading to a denial of service condition.

Impact Analysis

The vulnerability allows unauthenticated attackers to trigger HTTP 500 errors by sending malformed Cookie headers. This results in denial of service, meaning legitimate users may be unable to access the affected application or service while it is disrupted.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Emmett framework to version 1.3.11 or later, where the issue with handling CookieError exceptions in the cookies property has been fixed.

Hi! I’m here to help you understand CVE-2026-25577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70