Falhas do tipo CWE-248

372 resultados

Exceção não capturada

Ocorre quando o código não trata exceções que podem ser lançadas durante a execução, permitindo que erros se propaghem de forma descontrolada. Isso pode expor informações sensíveis em mensagens de erro, causar travamentos inesperados ou deixar a aplicação em estado inconsistente.

Exemplo

Um endpoint de API que tenta conectar a um banco de dados sem try-catch: se a conexão falhar, a exceção não tratada retorna um stack trace completo ao cliente, revelando caminho do servidor, versões de bibliotecas e estrutura interna do código.

Como mitigar

Envolva operações críticas (I/O, rede, parsing) em blocos try-catch apropriados, registre erros adequadamente em logs internos e retorne mensagens de erro genéricas ao usuário. Implemente um handler global de exceções na aplicação para capturar falhas não previstas.

CVE-2026-72813MEDIUMactix-files before 0.6.10 Denial of Service via empty Range headerEPSS 0.5%CVE-2026-92954CRITICALvm2 3.10.0 through 3.11.7 Denial of Service via Host PromiseEPSS 0.5%CVE-2026-55484HIGHALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverEPSS 0.5%CVE-2026-82254HIGHgitoxide before 0.69.0 Denial of Service via gix-packEPSS 0.5%CVE-2026-77078HIGHmulter vulnerable to Denial of Service via crafted multipart field namesEPSS 0.5%CVE-2026-47480HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit ofEPSS 0.5%CVE-2026-88411HIGHImproper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of SerEPSS 0.5%CVE-2025-48997HIGHMulter vulnerable to Denial of Service via unhandled exceptionEPSS 0.5%CVE-2026-32314HIGHYamux remote Panic via malformed Data frame with SYN set and len = 262145EPSS 0.5%CVE-2024-3051HIGHZ/IP Gateway Device Reset Locally Denial of Service VulnerabilityEPSS 0.5%CVE-2025-20097MEDIUMUncaught exception in OpenBMC Firmware for the Intel(R) Server M50FCP Family and Intel(R) Server D50DNP Family before version R01.02.0002 maEPSS 0.5%CVE-2026-8161HIGHmultiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught ExceptionEPSS 0.5%CVE-2025-54134HIGHHAX CMS NodeJs's Improper Error Handling Leads to Denial of ServiceEPSS 0.5%CVE-2024-58358MEDIUMSurrealDB before 2.1.0 Denial of Service via Nonexistent RoleEPSS 0.5%CVE-2026-31870HIGHcpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response HeaderEPSS 0.5%CVE-2026-24175HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tEPSS 0.5%CVE-2026-20031MEDIUMClamAV CSS Image Parsing Error Handling Denial of Service VulnerabilityEPSS 0.5%CVE-2026-20068MEDIUMMultiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityEPSS 0.5%CVE-2026-92608HIGHApache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10EPSS 0.5%CVE-2025-44019HIGHAVEVA PI Data Archive Uncaught ExceptionEPSS 0.5%