Weakness (CWE)
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
How to prevent it (3 mitigations)
-
Requirements
The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
-
Requirements
A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
-
Implementation
Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
Source: MITRE CWE-248
204 results · Clear filters · Feed
-
High 7.5
A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leadin…
-
High 8.7CVE-2013-10065 Public exploit
Sysax Multi-Server <= 6.10 SSHD Key Exchange DoS
A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of mal…
-
High 7.7
Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service
Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or …
-
High 7.1
HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerabili…
-
High 7.5CVE-2025-7338 Public exploit
Multer vulnerable to Denial of Service via unhandled exception from malformed request
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload requ…
-
High 8.7
MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unava…
-
High 8.7
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught Closed…
-
High 7.1
AVEVA PI Data Archive Uncaught Exception
AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service. Depending on the timing of the crash, dat…
-
High 8.7
Multer vulnerable to Denial of Service via unhandled exception
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an emp…
-
High 7.5
quic-go Has Panic in Path Probe Loss Recovery Handling
quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first se…
-
High 7.5
Multer vulnerable to Denial of Service from maliciously crafted requests
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload requ…
-
High 7.5
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when execut…
-
High 7.5
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistent…
-
High 8.7
tRPC 11 WebSocket DoS Vulnerability
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This a…
-
High 7.5
Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitatio…
-
High 7.5
Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitatio…
-
High 7.5
In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (…
-
High 7.5
In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (…
-
High 7.5
Malformed MongoDB wire protocol messages may cause mongos to crash
Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20…
-
High 7.5
Denial of Service in danny-avila/librechat
A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled excepti…
-
High 7.5
Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm
mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoi…
-
High 7.5
Denial of Service in lightning-ai/pytorch-lightning
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected s…
-
High 8.2
Formwork improperly validates input of User role preventing site and panel availability
### Summary Improper validation of select fields allows attackers to craft an input that crashes the system, resulting in a 500 status and making the entire site and administration panel unavailable. This clearly impacts the Availability aspect of the CIA tri…
-
High —
Uncaught Panic in ORML Rewards Pallet
## Summary A vulnerability in the `add_share` function of the **Rewards** pallet (part of the ORML repository) can lead to an uncaught Rust panic when handling user-provided input exceeding the `u128` range. ## Affected Components - **ORML Rewards** pallet (`…
-
High 7.1
Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception
With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings an…
-
High 7.7
A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, rem…
-
High 7.7
A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, rem…
-
High 7.7
A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could all…
-
High 7.7
A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, rem…
-
High 7.5
In network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of servic…
-
High 8.7
go-ethereum has a DoS via malicious p2p message
go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13.
-
High 7.1
Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerabili…
-
High 7.5
rPGP Panics on Malformed Untrusted Input
rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.
-
High 7.5CVE-2024-20137 Public exploit
In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. This could…
-
High 7.5
Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts. B…
-
High 8.6
JavaScript specification issue may lead to type confusion and pointer dereference in implementations
ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a s…
-
High 8.6
phonenumber panics on parsing crafted phonenumber inputs
phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber…
-
High 7.5
dd-trace-cpp malformed unicode header values may cause crash
dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the `nlohmann` JSON library. However, due to the way the JSON library…
-
High 7.5
Panic when parsing invalid palette-color images in golang.org/x/image
Parsing a corrupt or malicious image with invalid color indices can cause a panic.
-
High 8.7
Unauthenticated DoS
badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access the web management page of the camera. and must manually restart the device or re-power it. The man…