CVE-2026-25577: Emmett-Core Denial of Service via Unhandled CookieError Exception
Summary
CVE-2026-25577: Emmett-Core: Unhandled CookieError Exception Causing Denial of Service. Affects emmett-core versions < 1.3.11. Fixed in 1.3.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Emmett-Core is a Python web framework designed for building web applications. It provides a range of features including routing, session management, and HTTP request handling. The framework is widely used for its simplicity and flexibility. However, it has a vulnerability related to how it processes Cookie headers, which can lead to denial of service under certain conditions.
Vulnerability Detail
The vulnerability arises from the cookies property in emmett_core.http.wrappers.Request, which does not handle CookieError exceptions when parsing malformed Cookie headers. This oversight allows unauthenticated attackers to send specially crafted Cookie headers that trigger HTTP 500 errors, leading to denial of service. The lack of exception handling means that the server can become unresponsive after repeated attacks, significantly degrading performance and availability.
How To Fix
Minimum fixed version
1.3.11
This is the first release that contains the fix.
pip install --upgrade "emmett-core==1.3.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy or web application firewall that filters out malformed Cookie headers before they reach the Emmett-Core application. This can help mitigate the impact of the vulnerability until a proper fix is applied.
Conclusion
CVE-2026-25577 is a significant vulnerability in the Emmett-Core framework that can lead to denial of service through unhandled CookieError exceptions. It is crucial to update to the patched version 1.3.11 or later and implement the recommended code changes to ensure the security and availability of your application.
See every vulnerability recorded for emmett-core →
FAQ
CVE-2026-25577 is a vulnerability in the Emmett-Core framework that allows unauthenticated attackers to cause denial of service by sending malformed Cookie headers.
If your application uses Emmett-Core and does not handle malformed Cookie headers properly, it may become unresponsive, leading to service downtime.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider implementing a reverse proxy to filter out malformed Cookie headers as a temporary measure.
