Weaknesses of type CWE-248

381 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-121414HIGHParse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer UpdateEPSS 0.3%CVE-2026-105756MEDIUMvLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of serviceEPSS 0.3%CVE-2024-49705MEDIUMXSS in iKSORISEPSS 0.3%CVE-2023-25526MEDIUMNVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exceEPSS 0.3%CVE-2026-120216MEDIUMfastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responsesEPSS 0.3%CVE-2026-116589HIGHDatadog dd-trace-py: IAST instrumentation can lead to application DOSEPSS 0.3%CVE-2026-65834MEDIUMCapsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsEPSS 0.3%CVE-2026-25577HIGHEmmett has an Unhandled CookieError Exception Causing Denial of ServiceEPSS 0.3%CVE-2026-103387MEDIUMgarycourt uri-js Mailto Header mailto.ts URI.parse uncaught exceptionEPSS 0.3%CVE-2026-46689HIGHKanidm: Unauthenticated process abort via SCIM filter stack exhaustionEPSS 0.3%CVE-2024-51518MEDIUMVulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may EPSS 0.3%CVE-2026-100722HIGHvm2 before 3.12.2 Host Process Termination via Construct TrapEPSS 0.3%CVE-2026-55517MEDIUMDeno: Denial of service via non-ASCII bytes in WebSocket response headersEPSS 0.3%CVE-2026-105757MEDIUMvLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)EPSS 0.3%CVE-2026-117541MEDIUMsvg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()EPSS 0.3%CVE-2026-85494HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)EPSS 0.3%CVE-2026-120222MEDIUMundici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replayEPSS 0.3%CVE-2026-109338HIGHSurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII ValuesEPSS 0.3%CVE-2026-89090HIGHDenial of service in the event stream header decoder in AWS SDK for Go v2EPSS 0.3%CVE-2026-122314HIGHKyverno before 1.19.2 Denial of Service via Shallow Variable Substitution PanicEPSS 0.3%