What is the CVSS score of CVE-2026-25577?

CVE-2026-25577 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Emmett are affected by CVE-2026-25577?

Emmett framework versions up to 1.3.11 contain a denial of service vulnerability that allows attackers to crash affected applications by triggering HTTP 500 errors, potentially disrupting service…. A patch is available.

How to fix or mitigate CVE-2026-25577?

Within 24 hours: inventory all systems running Emmett framework versions ≤1.3.11 and assess business criticality of each instance. Within 7 days: implement WAF rules to detect and block malformed requests triggering the vulnerability, enable rate limiting on affected endpoints, and establish monitoring for HTTP 500 error spikes. Within 30 days: plan and execute upgrade to Emmett 1.3.12 or later once patch is released, or migrate to alternative frameworks if upgrade is not feasible.

Emmett CVE-2026-25577

HIGH

Uncaught Exception (CWE-248)

2026-02-10 security-advisories@github.com

GHSA-x6cr-mq53-cc76

Denial Of Service

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on emmett-core (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.3.11.

DescriptionGitHub Advisory

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.

AnalysisAI

Emmett is a framework designed to simplify your development process. versions up to 1.3.11 contains a vulnerability that allows attackers to trigger HTTP 500 errors and cause denial of service (CVSS 7.5).

Technical ContextAI

affects Emmett is a framework designed to simplify your development process.. Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.