Weakness (CWE)
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
How to prevent it (3 mitigations)
-
Requirements
The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
-
Requirements
A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
-
Implementation
Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
Source: MITRE CWE-248
204 results · Clear filters · Feed
-
High 7.5
Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller cat…
-
High 7.5
Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic
Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to by…
-
High 7.5
Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic
Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow s…
-
High 8.7
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/…
-
High 7.5
FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers
FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipbo…
-
High 8.4
In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local esc…
-
High 8.4
In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. T…
-
High 7.5
Aedes has Uncaught Exception and Uncontrolled Resource Consumption
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message con…
-
High 7.5
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input …
-
High 7.5
llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length
llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a comman…
-
High 8.7
Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. R…
-
High 8.2
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled e…
-
High 7.5
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding suc…
-
High 7.5CVE-2026-113872 Public exploit
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while o…
-
High 7.5
Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address mul…
-
High 7.5
Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without cat…
-
High 7.5CVE-2026-114102 Public exploit
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a…
-
High 7.5
vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attack…
-
High 7.5
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call g…
-
High 7.5
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…
-
High 7.5
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…
-
High 7.5
libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connec…
-
High 7.5
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or …
-
High 7.5
HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability
A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.
-
High 7.5
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, s…
-
High 8.2
Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verifica…
-
High 7.5
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored …
-
High 7.5
Windows Failover Cluster Denial of Service Vulnerability
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
-
High 8.7
Qwik: Crashing any Qwik Server via Resource thenable
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first r…
-
High 7.5
Windows DNS Denial of Service Vulnerability
Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.
-
High 7.5
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and di…
-
High 7.5
Gitea denial of service through external issue tracker patterns
A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repositor…
-
High 7.8
In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escala…
-
High 8.2
Apache Thrift: Perl servers end `serve()` when serving one connection fails
Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 8.7
Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 8.7
Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. …
-
High 8.2
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to ver…
-
High 8.7
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version…
-
High 8.7
Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 8.7
Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.