CVE-2026-25577: Emmett-Core: Unhandled CookieError Exception Causing Denial of Service

February 10, 2026

The cookies property in emmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service.

References

github.com/advisories/GHSA-x6cr-mq53-cc76
github.com/emmett-framework/core
github.com/emmett-framework/core/commit/c126757133e118119a280b58f3bb345b1c9a8a2a
github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76
nvd.nist.gov/vuln/detail/CVE-2026-25577

Code Behaviors & Features

Detect and mitigate CVE-2026-25577 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →