CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
A kind of CWE-705 Incorrect Control Flow Scoping.
From the CWE List. © The MITRE Corporation.
Newest
- surrealdbSurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values7.1 High
- parse-community parse-serverParse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL8.2 High
- nodejs undiciundici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake7.5 High
- getkin kin-openapikin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path5.3 Medium
- cthackers adm-zipadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event8.7 High
- borewit music-metadatamusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)6.2 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS5.9 Medium
- excelizeExcelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks7.5 High
- apache software foundation yunikornApache YuniKorn: LDAP Group provider panics on lowercase attribute name2.1 Low
- elastic agent and elastic defendUncaught Exception in Elastic Endpoint Leading to Denial of Service6.2 Medium
- giteaGitea denial of service through external issue tracker patterns7.5 High
- vmware rabbitmq java client, com.rabbitmq amqp-client, rabbitmq rabbitmq-java-client +2 moreRabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers6.0 Medium
- getkin kin-openapikin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items7.5 High
- vllmvLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)6.5 Medium
- vllmvLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service6.5 Medium
- apache software foundation thriftApache Thrift: Perl servers end `serve()` when serving one connection fails8.2 High
- apache software foundation thriftApache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception8.7 High
- apache software foundation thriftApache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)8.7 High
- apache software foundation thriftApache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service8.2 High
- apache software foundation thriftApache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service8.7 High
- apache software foundation thriftApache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection8.7 High
- apache software foundation thriftApache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception8.7 High
- apache software foundation thriftApache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)8.7 High
- apache software foundation thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pee…8.7 High
- apache software foundation thriftApache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)8.2 High
- google androidIn multiple places, there is a possible denial of service due to an uncaught exception. This...7.8 High
- garycourt uri-jsgarycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception5.3 Medium
- withastro astroAstro: Malformed port in the Host header can crash the Node adapter8.2 High
- apache software foundation plc4xApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them8.5 High
- socketio socket.ioSocket.IO: Engine.IO Protocol Revision Mismatch DoS7.5 High
- cthackers adm-zipadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass8.2 High
- baicells nova 430h enodeb (model pbs3101sh)Uncaught exception in Baicells Nova 430H8.3 High
- nestjs nestNest: Remote process termination via a deeply nested microservice message pattern7.5 High
- jpadilla pyjwtPyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)5.3 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception5.3 Medium
- aligungr ueransimaligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception6.9 Medium
- patriksimek vm2vm2 before 3.12.2 Host Process Termination via Construct Trap8.9 High
- stoatchatstoatchat before 0.15.5 Denial of Service via mass mentions7.1 High
- apache qpid broker-jApache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-107.5 High
- zohocorp eventlog analyzer, log360 +1 moreDenial of Service (DoS)5.3 Medium
- moquetteMoquette fails open when configured authentication or authorization classes cannot load9.3 Critical
- moquetteMoquette client IDs can cause cross-session H2 durable-queue corruption8.8 High
- moquetteMoquette publishes Last-Will messages without enforcing write authorization8.7 High
- moquetteMoquette unbounded per-session message queues allow memory exhaustion8.7 High
- moquetteMoquette deeply nested MQTT topics can cause stack exhaustion8.7 High
- moquetteMoquette malformed shared subscriptions can crash command processing8.7 High
- moquetteMoquette uncaught MQTT command exceptions can terminate shared session event loops8.7 High
- moquetteMoquette pattern ACL wildcard injection allows cross-tenant authorization bypass9.6 Critical
- azu request-filtering-agentrequest-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process7.5 High
- vllmvLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata8.7 High
- Show moreLoading…