7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25577

CVE-2026-25577: Emmett has an Unhandled CookieError Exception Causing Denial of Service

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25577

CVE-2026-25577:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
emmett-core	pip	<= 1.3.10	1.3.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic unhandled exception issue. The Request.cookies property in emmett_core/http/wrappers/__init__.py is responsible for parsing cookies from the request headers. It uses Python's http.cookies.SimpleCookie.load method, which is known to raise CookieError on malformed input. The vulnerable version of the code did not wrap the cookies.load(cookie) call in a try-except block. Consequently, an unauthenticated attacker could send a request with a specially crafted Cookie header (e.g., containing characters like /, (, )), causing a CookieError to be raised. This unhandled exception would propagate up the call stack, resulting in an HTTP 500 Internal Server Error and effectively causing a denial of service. The provided patch confirms this analysis by wrapping the vulnerable call in a try...except block, thus catching the exception and preventing the application from crashing.

Vulnerable functions

Request.cookies

emmett_core/http/wrappers/__init__.py

The `cookies` property within the `Request` class processes the `Cookie` header from HTTP requests. The vulnerability lies in the fact that it calls `cookies.load(cookie)` without handling potential `CookieError` exceptions. A malformed cookie sent by an attacker will trigger this unhandled exception, leading to a server error and a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.