Skip to content
OpenAdvisories

Weakness (CWE)

CWE-248: Uncaught Exception

Base Draft

An exception is thrown from a function, but it is not caught.

How to prevent it (3 mitigations)

  1. Requirements

    The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.

  2. Requirements

    A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.

  3. Implementation

    Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.

Source: MITRE CWE-248

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.5
    CVE-2026-113872 Public exploit

    multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

    multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while o…

    multer multer multer node-multer Debian npm
  • High 7.5
    CVE-2026-114102 Public exploit

    adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

    adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a…

    cthackers adm-zip adm-zip npm
  • High 7.5
    CVE-2026-77078 Public exploit

    multer vulnerable to Denial of Service via crafted multipart field names

    multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a…

    multer multer multer node-multer Debian npm
  • High 7.5
    CVE-2026-52856 Public exploit

    Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

    Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

    pterodactyl wings github.com/pterodactyl/wings Go
  • Low 2.4
    CVE-2026-55780 Public exploit

    NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size

    NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is on…

    M2Team NanaZip
  • High 7.5
    CVE-2026-8161 Public exploit

    multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception

    multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, t…

    multiparty multiparty node-multiparty node-multiparty Debian Ubuntu npm
  • High 8.7
    CVE-2013-10065 Public exploit

    Sysax Multi-Server <= 6.10 SSHD Key Exchange DoS

    A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of mal…

    Sysax Software Multi Server
  • High 7.5
    CVE-2025-7338 Public exploit

    Multer vulnerable to Denial of Service via unhandled exception from malformed request

    Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload requ…

    expressjs multer multer npm
  • Medium 6.2
    CVE-2025-48907 Public exploit

    Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availa…

    Huawei HarmonyOS Network devices
  • High 7.5
    CVE-2024-20137 Public exploit

    In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could…

    MediaTek MT6890, MT7622, MT7915, MT7916, MT7981, MT7986
  • Medium 6.5
    CVE-2023-22941 Public exploit

    Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2022-24434 Public exploit

    Denial of Service (DoS)

    This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

    dicer org.webjars.npm:dicer npm Maven
  • High 7.5
    CVE-2018-7852 Public exploit

    A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, …