CVE-2026-25577

Published: Feb 10, 2026Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.

Related CWEs

CWE-248

Uncaught Exception

An exception is thrown from a function, but it is not caught.

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (3)

https://github.com/emmett-framework/core/commit/9557ea23a27cbadf7774d8bca6bbe4b54fa8a3ec

Source: security-advisories@github.com

https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76

Source: security-advisories@github.com

https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.