Fallos del tipo CWE-248

381 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-121414HIGHParse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer UpdateEPSS 0.3%CVE-2026-105756MEDIUMvLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of serviceEPSS 0.3%CVE-2024-49705MEDIUMXSS in iKSORISEPSS 0.3%CVE-2023-25526MEDIUMNVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exceEPSS 0.3%CVE-2026-120216MEDIUMfastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responsesEPSS 0.3%CVE-2026-116589HIGHDatadog dd-trace-py: IAST instrumentation can lead to application DOSEPSS 0.3%CVE-2026-65834MEDIUMCapsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsEPSS 0.3%CVE-2026-25577HIGHEmmett has an Unhandled CookieError Exception Causing Denial of ServiceEPSS 0.3%CVE-2026-103387MEDIUMgarycourt uri-js Mailto Header mailto.ts URI.parse uncaught exceptionEPSS 0.3%CVE-2026-46689HIGHKanidm: Unauthenticated process abort via SCIM filter stack exhaustionEPSS 0.3%CVE-2024-51518MEDIUMVulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may EPSS 0.3%CVE-2026-100722HIGHvm2 before 3.12.2 Host Process Termination via Construct TrapEPSS 0.3%CVE-2026-55517MEDIUMDeno: Denial of service via non-ASCII bytes in WebSocket response headersEPSS 0.3%CVE-2026-105757MEDIUMvLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)EPSS 0.3%CVE-2026-117541MEDIUMsvg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()EPSS 0.3%CVE-2026-85494HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)EPSS 0.3%CVE-2026-120222MEDIUMundici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replayEPSS 0.3%CVE-2026-109338HIGHSurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII ValuesEPSS 0.3%CVE-2026-89090HIGHDenial of service in the event stream header decoder in AWS SDK for Go v2EPSS 0.3%CVE-2026-122314HIGHKyverno before 1.19.2 Denial of Service via Shallow Variable Substitution PanicEPSS 0.3%