Falhas do tipo CWE-248

291 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%CVE-2025-20663HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-20664HIGHIn wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) inEPSS 0.5%CVE-2025-48942MEDIUMvLLM DOS: Remotely kill vllm over http with invalid JSON schemaEPSS 0.5%CVE-2025-67647HIGHSvelteKit Denial of service and possible SSRF when using prerenderingEPSS 0.5%CVE-2023-29520MEDIUMPage render failure due to broken translations in xwiki-platformEPSS 0.5%CVE-2026-48038MEDIUMjoi: Uncaught RangeError on deeply nested input through recursive `link()` schemasEPSS 0.5%CVE-2026-14631MEDIUMwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerEPSS 0.5%CVE-2024-31904MEDIUMIBM App Connect Enterprise denial of serviceEPSS 0.5%CVE-2026-63747HIGHSurrealDB before 3.1.0 Denial of Service via malformed RPC useEPSS 0.5%CVE-2024-3052HIGHZ/IP Gateway S2 Nonce Get Denial of Service VulnerabilityEPSS 0.5%CVE-2025-0648MEDIUMM-Files Server crash via EOT database driver configurationEPSS 0.5%CVE-2025-59462MEDIUMDenial-of-service (DoS) via delayed or missing client responseEPSS 0.5%CVE-2022-51014HIGHPocketMine-MP before 4.0.7 Denial of Service via JSON DecodingEPSS 0.5%CVE-2026-59875MEDIUMnode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsEPSS 0.5%CVE-2025-20758MEDIUMIn Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected EPSS 0.5%CVE-2026-12644MEDIUMVersions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.protoEPSS 0.5%CVE-2026-31812HIGHQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingEPSS 0.5%CVE-2026-14181HIGH@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsEPSS 0.5%CVE-2026-33203HIGHSiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive BypassEPSS 0.5%