PT-2026-7320 · Emmett · Emmett

Ryu-Geonwoo · Published 2026-02-10 · Updated 2026-02-11 · CVE-2026-25577

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Emmett versions prior to 1.3.11

Description The cookies property in emmett core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. Sending cookies containing special characters such as /(){} can result in insufficient error handling and a server error. The vulnerable code is located in emmett core/http/wrappers/ init .py at line 64. The issue can lead to performance degradation and difficulty in using the service normally.

Recommendations Update to Emmett version 1.3.11 or later.

Exploit

Fix

DoS

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-248

CWE-703

Related Identifiers

CVE-2026-25577

GHSA-X6CR-MQ53-CC76

Affected Products

Emmett

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25577.json · Exploit
• 🔥 https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76 · Exploit
• https://osv.dev/vulnerability/CVE-2026-25577 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x6cr-mq53-cc76 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25577 · Security Note
• https://github.com/emmett-framework/core · Note
• https://github.com/emmett-framework/core/commit/c126757133e118119a280b58f3bb345b1c9a8a2a · Note
• https://github.com/emmett-framework/core/commit/9557ea23a27cbadf7774d8bca6bbe4b54fa8a3ec · Note
• https://twitter.com/VulmonFeeds/status/2021385790798839836 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post