Falhas do tipo CWE-248

379 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2024-8249HIGHUnauthenticated Denial of Service (DoS) in mintplex-labs/anything-llmEPSS 0.7%CVE-2023-3774MEDIUMVault Enterprise Namespace Creation May Lead to Denial of ServiceEPSS 0.7%CVE-2025-24883HIGHgo-ethereum has a DoS via malicious p2p messageEPSS 0.7%CVE-2025-59466MEDIUMWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.creaEPSS 0.7%CVE-2024-23449MEDIUMElasticsearch Uncaught ExceptionEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2024-34363HIGHEnvoy can crash due to uncaught nlohmann JSON exceptionEPSS 0.7%CVE-2019-7474—A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloaEPSS 0.7%CVE-2023-22290MEDIUMUncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network accessEPSS 0.7%CVE-2026-34986HIGHGo JOSE affect by a panic in JWE decryptionEPSS 0.7%CVE-2026-73088HIGHBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)EPSS 0.7%CVE-2026-59162MEDIUMExcelize: Negative shared-string index causes panic in GetCellValue and GetRowsEPSS 0.7%CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2025-20637HIGHIn network HW, there is a possible system hang due to an uncaught exception. This could lead to remote denial of service with no additional EPSS 0.6%CVE-2024-8020HIGHDenial of Service in lightning-ai/pytorch-lightningEPSS 0.6%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.6%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2026-94622HIGHvLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer MetadataEPSS 0.6%CVE-2023-42447HIGHblurhash panics on parsing crafted inputsEPSS 0.6%CVE-2026-67416MEDIUMRabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validationEPSS 0.6%