Vulnerability · Published Feb 10, 2026 · Assigned by GitHub_M

CVE-2026-25577Emmett has an Unhandled CookieError Exception Causing Denial of Service

High 7.5

In plain English

A high-severity security flaw in core from emmett-framework. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	emmett-core	1.3.11	GHSA-x6cr-mq53-cc76
PyPI	emmett-core	1.3.11	PYSEC-2026-2469

Affected products (as reported)

Vendor	Product	Versions
emmett-framework	core	< 1.3.11

Weakness: CWE-248, CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76 x_refsource_CONFIRM
https://github.com/emmett-framework/core/commit/9557ea23a27cbadf7774d8bca6bbe4b54fa8a3ec x_refsource_MISC