Weaknesses of type CWE-248

291 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%CVE-2025-20664HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-20663HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-48942MEDIUMvLLM DOS: Remotely kill vllm over http with invalid JSON schemaEPSS 0.5%CVE-2025-67647HIGHSvelteKit Denial of service and possible SSRF when using prerenderingEPSS 0.5%CVE-2023-29520MEDIUMPage render failure due to broken translations in xwiki-platformEPSS 0.5%CVE-2026-48038MEDIUMjoi: Uncaught RangeError on deeply nested input through recursive `link()` schemasEPSS 0.5%CVE-2026-14631MEDIUMwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerEPSS 0.5%CVE-2024-31904MEDIUMIBM App Connect Enterprise denial of serviceEPSS 0.5%CVE-2026-63747HIGHSurrealDB before 3.1.0 Denial of Service via malformed RPC useEPSS 0.5%CVE-2024-3052HIGHZ/IP Gateway S2 Nonce Get Denial of Service VulnerabilityEPSS 0.5%CVE-2025-0648MEDIUMM-Files Server crash via EOT database driver configurationEPSS 0.5%CVE-2025-59462MEDIUMDenial-of-service (DoS) via delayed or missing client responseEPSS 0.5%CVE-2022-51014HIGHPocketMine-MP before 4.0.7 Denial of Service via JSON DecodingEPSS 0.5%CVE-2026-59875MEDIUMnode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsEPSS 0.5%CVE-2025-20758MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2026-12644MEDIUMVersions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.protoEPSS 0.5%CVE-2026-31812HIGHQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingEPSS 0.5%CVE-2026-14181HIGH@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsEPSS 0.5%CVE-2026-33203HIGHSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassEPSS 0.5%