Fallos del tipo CWE-248

379 resultados

Exceção Não Capturada

Quando o código não trata adequadamente exceções ou erros gerados durante a execução, permitindo que eles se propaguem sem controle. Isso causa interrupção inesperada do programa, possível revelação de informações sensíveis em mensagens de erro e deixa a aplicação em estado indefinido ou vulnerável.

Ejemplo

Um endpoint web tenta acessar um arquivo ou banco de dados sem try-catch; se o recurso não existir, a exceção não tratada expõe stack traces contendo caminhos internos, credenciais ou detalhes da infraestrutura para o cliente atacante.

Cómo mitigar

Implemente blocos try-catch específicos para cada operação que possa falhar (I/O, banco de dados, rede). Defina um mecanismo centralizado de tratamento de erros que logue internamente sem expor detalhes ao usuário final, e sempre finalize recursos (conexões, arquivos) em blocos finally ou use try-with-resources.

CVE-2026-97394HIGHkin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsEPSS 0.6%CVE-2026-119052HIGHllama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg LengthEPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2026-77781HIGHTie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keysEPSS 0.6%CVE-2022-51009HIGHPocketMine-MP before 4.7.2 Denial of Service via Skin GeometryEPSS 0.6%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2024-43367HIGHBoa has an uncaught exception when transitioning the state of `AsyncGenerator` objectsEPSS 0.6%CVE-2025-32944MEDIUMPeerTube User Import Authenticated Persistent Denial of ServiceEPSS 0.6%CVE-2026-102281HIGHNest: Remote process termination via a deeply nested microservice message patternEPSS 0.6%CVE-2026-32770MEDIUMParse Server: LiveQuery subscription with invalid regular expression crashes serverEPSS 0.6%CVE-2026-82410HIGHPocketbase: Unhandled panic in worker goroutinesEPSS 0.6%CVE-2026-102599HIGHSocket.IO: Engine.IO Protocol Revision Mismatch DoSEPSS 0.6%CVE-2025-48942MEDIUMvLLM DOS: Remotely kill vllm over http with invalid JSON schemaEPSS 0.6%CVE-2026-31812HIGHQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingEPSS 0.6%CVE-2026-13697HIGHundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesEPSS 0.6%CVE-2026-62985HIGHrequest-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js processEPSS 0.6%CVE-2026-18675MEDIUMKong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kidEPSS 0.6%CVE-2026-55780LOWNanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry SizeEPSS 0.6%