Falhas do tipo CWE-248

291 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-88015MEDIUMrclone local: crafted Range request against a translated symlink panics (DoS)EPSS 0.4%CVE-2026-9509HIGHUncaught exception vulnerability in Suprema's BioStarEPSS 0.4%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.4%CVE-2026-37554HIGHAn issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists EPSS 0.4%CVE-2023-5310MEDIUMZ-Wave Denial of Service caused by Stream of PacketsEPSS 0.3%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.3%CVE-2026-92954CRITICALvm2 3.10.0 through 3.11.5 Denial of Service via Host PromiseEPSS 0.3%CVE-2026-45554MEDIUMNiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routesEPSS 0.3%CVE-2024-52903MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2026-46545HIGHnimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed itemEPSS 0.3%CVE-2022-51009HIGHPocketMine-MP before 4.7.2 Denial of Service via Skin GeometryEPSS 0.3%CVE-2026-61666HIGHwebsocket-driver: Denial of service via malformed Host headerEPSS 0.3%CVE-2023-52342HIGHIn modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosuEPSS 0.3%CVE-2025-0657HIGHALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-rangeEPSS 0.3%CVE-2026-54553MEDIUMStarlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoSEPSS 0.3%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.3%CVE-2023-25526MEDIUMNVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exceEPSS 0.3%CVE-2026-42544HIGHGranian: Unauthenticated DoS via WebSocket subprotocol header panicEPSS 0.3%CVE-2026-34943MEDIUMWasmtime panics when lifting `flags` component valueEPSS 0.3%CVE-2024-49705MEDIUMXSS in iKSORISEPSS 0.3%