Weaknesses of type CWE-248

291 results

Exceção não capturada

Quando o código não trata adequadamente exceções lançadas durante a execução, permitindo que elas se propaguem sem controle. Isso pode expor informações sensíveis em mensagens de erro, causar parada inesperada do serviço ou deixar o sistema em estado inconsistente.

Example

Uma aplicação web que não captura exceções de banco de dados mostra ao usuário o stack trace completo com credenciais, caminho de arquivos ou consultas SQL. Ou um serviço de API que trava quando recebe um JSON malformado, sem retornar um erro controlado ao cliente.

How to mitigate

Implemente blocos try-catch em pontos críticos (I/O, banco de dados, operações sensíveis) e retorne erros genéricos ao usuário. Registre exceções em logs internos com contexto completo, sem expor detalhes técnicos na resposta pública. Use tratadores globais de exceções para garantir comportamento consistente e seguro.

CVE-2026-33203HIGHSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassEPSS 0.5%CVE-2025-20754MEDIUMIn Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connecEPSS 0.5%CVE-2025-20753MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2024-21983MEDIUMDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) EPSS 0.5%CVE-2026-1528HIGHundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientEPSS 0.5%CVE-2026-47480HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit ofEPSS 0.5%CVE-2025-47281HIGHKyverno's Improper JMESPath Variable Evaluation Leads to Denial of ServiceEPSS 0.5%CVE-2025-29785HIGHquic-go Has Panic in Path Probe Loss Recovery HandlingEPSS 0.5%CVE-2024-3051HIGHZ/IP Gateway Device Reset Locally Denial of Service VulnerabilityEPSS 0.5%CVE-2025-48943MEDIUMvLLM allows clients to crash the openai server with invalid regexEPSS 0.5%CVE-2025-20097MEDIUMUncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 maEPSS 0.5%CVE-2026-8161HIGHmultiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught ExceptionEPSS 0.5%CVE-2024-58358MEDIUMSurrealDB before 2.1.0 Denial of Service via Nonexistent RoleEPSS 0.5%CVE-2026-24175HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tEPSS 0.5%CVE-2026-45685HIGHOpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messagesEPSS 0.5%CVE-2026-13697HIGHundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesEPSS 0.5%CVE-2026-73418HIGHNextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersEPSS 0.5%CVE-2026-50129HIGHMastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMEREPSS 0.5%CVE-2026-62994LOWCoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginEPSS 0.5%CVE-2026-31870HIGHcpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response HeaderEPSS 0.5%