CVE-2026-25577
Published: 10 February 2026
Summary
CVE-2026-25577 is a high-severity Uncaught Exception (CWE-248) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control directly enforces limits on consecutive invalid logon attempts and automatic response (e.g., lockout) to prevent brute-force exploitation of authentication mechanisms.
Specific conditions can include excessive failed attempts, triggering stronger authentication that restricts brute-force exploitation.
Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode.
Requires pre-defined safe responses for uncaught exceptions so they do not result in undefined or insecure program termination.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unhandled CookieError exception from malformed headers directly enables remote unauthenticated application exploitation to crash the service and produce DoS (T1499.004).
NVD Description
Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial…
more
of service. This vulnerability is fixed in 1.3.11.
Deeper analysisAI
CVE-2026-25577 affects the Emmett framework, a tool designed to simplify development processes, specifically in versions prior to 1.3.11. The vulnerability resides in the cookies property of the mmett_core.http.wrappers.Request component, which fails to handle CookieError exceptions during parsing of malformed Cookie headers. This unhandled exception leads to HTTP 500 errors. The issue is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-248 (Uncaught Exception) and CWE-307 (Improper Restriction of Excessive Authentication Attempts, though primarily manifesting as a DoS vector).
Unauthenticated remote attackers can exploit this vulnerability by sending HTTP requests with specially crafted, malformed Cookie headers to any endpoint processed by the affected Request wrapper. Successful exploitation triggers the unhandled exception, resulting in server-side HTTP 500 errors and potential denial of service through resource exhaustion or service unavailability, without requiring privileges, user interaction, or impacting confidentiality or integrity.
The Emmett framework maintainers addressed this in version 1.3.11, as detailed in the fix commit at https://github.com/emmett-framework/core/commit/9557ea23a27cbadf7774d8bca6bbe4b54fa8a3ec and the GitHub security advisory at https://github.com/emmett-framework/core/security/advisories/GHSA-x6cr-mq53-cc76. Security practitioners should upgrade to Emmett 1.3.11 or later to mitigate the issue, and review deployments for exposure to unauthenticated HTTP traffic.
Details
- CWE(s)