PT-2026-7320 · Emmett · Emmett

Ryu-Geonwoo · Publicado 2026-02-10 · Atualizado 2026-02-11 · CVE-2026-25577

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Emmett versions prior to 1.3.11

Description The cookies property in emmett core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. Sending cookies containing special characters such as /(){} can result in insufficient error handling and a server error. The vulnerable code is located in emmett core/http/wrappers/ init .py at line 64. The issue can lead to performance degradation and difficulty in using the service normally.

Recommendations Update to Emmett version 1.3.11 or later.

Exploit

Correção

DoS

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

CWE-248

CWE-703

Identificadores relacionados

CVE-2026-25577

GHSA-X6CR-MQ53-CC76

Produtos afetados

Emmett

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25577.json · Exploit
• 🔥 https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76 · Exploit
• https://github.com/emmett-framework/core · Nota
• https://osv.dev/vulnerability/CVE-2026-25577 · Aviso do Fabricante
• https://github.com/emmett-framework/core/commit/c126757133e118119a280b58f3bb345b1c9a8a2a · Nota
• https://github.com/emmett-framework/core/commit/9557ea23a27cbadf7774d8bca6bbe4b54fa8a3ec · Nota
• https://osv.dev/vulnerability/GHSA-x6cr-mq53-cc76 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2021385790798839836 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25577 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Publicação no Reddit