Falhas do tipo CWE-248

379 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-97394HIGHkin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsEPSS 0.6%CVE-2026-119052HIGHllama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg LengthEPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2026-77781HIGHTie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keysEPSS 0.6%CVE-2022-51009HIGHPocketMine-MP before 4.7.2 Denial of Service via Skin GeometryEPSS 0.6%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.6%CVE-2026-58208MEDIUMNATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is EnabledEPSS 0.6%CVE-2026-54775MEDIUMCoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.EPSS 0.6%CVE-2024-43367HIGHBoa has an uncaught exception when transitioning the state of `AsyncGenerator` objectsEPSS 0.6%CVE-2025-32944MEDIUMPeerTube User Import Authenticated Persistent Denial of ServiceEPSS 0.6%CVE-2026-102281HIGHNest: Remote process termination via a deeply nested microservice message patternEPSS 0.6%CVE-2026-32770MEDIUMParse Server: LiveQuery subscription with invalid regular expression crashes serverEPSS 0.6%CVE-2026-82410HIGHPocketbase: Unhandled panic in worker goroutinesEPSS 0.6%CVE-2026-102599HIGHSocket.IO: Engine.IO Protocol Revision Mismatch DoSEPSS 0.6%CVE-2025-48942MEDIUMvLLM DOS: Remotely kill vllm over http with invalid JSON schemaEPSS 0.6%CVE-2026-31812HIGHQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingEPSS 0.6%CVE-2026-13697HIGHundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesEPSS 0.6%CVE-2026-62985HIGHrequest-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js processEPSS 0.6%CVE-2026-18675MEDIUMKong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kidEPSS 0.6%CVE-2026-55780LOWNanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry SizeEPSS 0.6%