Weakness (CWE)
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
How to prevent it (3 mitigations)
-
Requirements
The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
-
Requirements
A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
-
Implementation
Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
Source: MITRE CWE-248
177 results · Clear filters · Feed
-
Medium 6.2CVE-2025-48907 Public exploit
Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availa…
-
Medium 6.5
vLLM allows clients to crash the openai server with invalid regex
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulner…
-
Medium 6.5
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-…
-
Medium 6.5
Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to pot…
-
Medium 5.3
IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
-
Medium 6.5
PeerTube User Import Authenticated Persistent Denial of Service
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauz…
-
Medium 5.3
XSS in iKSORIS
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent requests will not be accep…
-
Medium 6.5
Unhandled Exception in danny-avila/librechat
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. …
-
Medium 4.3
Uncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before v…
-
Medium 5.5
IBM EntireX denial of service
IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation.
-
Medium 4.6
Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it…
-
Medium 5.3
Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the …
-
Medium 5.9
M-Files Server crash via EOT database driver configuration
Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change.
-
Medium 5.3
Rustls: rustls network-reachable panic in `acceptor::accept`
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
-
Medium 5.5
Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potential…
-
Medium 5.0
Element allows a malicious homeserver can modify events leading to unrenderable events or rooms
Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in …
-
Medium 5.3
Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of th…
-
Medium 4.9
Denial of Service in TYPO3 Bookmark Toolbar
TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versio…
-
Medium 6.5
Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially en…
-
Medium 5.3
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling
Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usu…
-
Medium 6.5
IBM App Connect Enterprise denial of service
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of service due to an uncaught exception. IBM X-Force ID: 289647.
-
Medium 6.2
Denial of service (DoS) vulnerability in the AMS module Impact: Successful exploitation of this vulnerability will affe…
-
Medium 4.4
In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local informatio…
-
Medium 6.2
In flashc, there is a possible information disclosure due to an uncaught exception. This could lead to local informatio…
-
Medium 4.3
Elasticsearch Uncaught Exception
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with passwo…
-
Medium 5.0
Gnutls: potential crash during chain building/verification
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.
-
Medium 6.5
Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability
Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier.
-
Medium 6.5
Silicon Labs PC Controller Denial of Service Vulnerability
Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability …
-
Medium 6.5
Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to an out of memory condition or node reboot.
-
Medium 4.3
Uncaught exception for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may a…
-
Medium 6.5
Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to a crash of the Local Distribution Router (LDR) service.
-
Medium 6.5
Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122.
-
Medium 5.7
Z-Wave Denial of Service caused by Stream of Packets
A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier. This attack can be carried out only by devices on the network sending a stream of packets to the dev…
-
Medium 6.5
Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of servi…
-
Medium 5.3
Panic in SignedPayload::from_payload
rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.
-
Medium 6.5
NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may c…
-
Medium 4.9
Vault Enterprise Namespace Creation May Lead to Denial of Service
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.
-
Medium 6.5
Uncaught exception in engine.io
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package…
-
Medium 5.5
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to l…
-
Medium 4.3
Page render failure due to broken translations in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. This will lead to a brok…