cve.bz

CWE-248: Uncaught Exception, page 5

Filter

An exception is thrown from a function, but it is not caught.

What the weakness is: CWE-248 at MITRE

Ask an AI about CWE-248

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-248: Uncaught Exception and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/248.html and https://cve.bz/cve/cwe/248?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.7CVE-2025-24851EPSS 0.1%

    Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a…

  2. 4.5CVE-2025-13064EPSS 0.2%

    A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.

  3. 7.5CVE-2026-25128EPSS 0.6%

    fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity proce…

  4. 7.5CVE-2025-59466EPSS 0.7%

    We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates…

  5. 7.5CVE-2025-59465EPSS 4.0%

    A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote …

  6. 8.4CVE-2025-67647EPSS 0.5%

    SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2…

  7. 7.5CVE-2025-66578EPSS 0.2%

    xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Versions 3.1.3 contain an authentication bypass vulnerability due to a flaw in the libxml2 canonicalization process during document transformation. When…

  8. 4.9CVE-2025-20758EPSS 0.5%

    In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.…

  9. 5.3CVE-2025-20754EPSS 0.5%

    In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges nee…

  10. 5.3CVE-2025-20753EPSS 0.5%

    In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.…

  11. 6.9CVE-2025-66305EPSS 0.4%

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported paramete…

  12. 8.8CVE-2025-0657EPSS 0.4%

    A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires …

  13. 5.6CVE-2025-8870EPSS 0.2%

    On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153

  14. 10.0CVE-2025-12423EPSS 0.3%

    Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .

  15. 7.5CVE-2025-59462EPSS 0.5%

    An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.

  16. 5.5CVE-2025-48430EPSS 0.1%

    Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to…

  17. 7.5CVE-2025-62370EPSS 0.4%

    Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Softw…

  18. 5.5CVE-2025-59229EPSS 0.4%

    Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.

  19. 8.7CVE-2025-9124EPSS 0.4%

    A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is sent. This can result in a major non-recoverable fault.

  20. 7.5CVE-2025-59538EPSS 9.4%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not…

  21. 7.5CVE-2025-55557EPSS 0.4%

    A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).

  22. 7.5CVE-2025-55553EPSS 0.4%

    A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).

  23. 6.9CVE-2025-35436EPSS 0.6%

    CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.

  24. 5.1CVE-2025-59014EPSS 0.3%

    An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving man…

  25. 5.3CVE-2025-54777EPSS 0.1%

    Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of-service issue that disable the Web Connection feature.

  26. 5.7CVE-2025-55194EPSS 0.4%

    Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 …

  27. 8.7CVE-2013-10065ExploitEPSS 1.8%

    A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during…

  28. 7.7CVE-2025-47281EPSS 0.6%

    Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permi…

  29. 7.1CVE-2025-54134EPSS 0.5%

    HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL paramete…

  30. 7.5CVE-2025-7338EPSS 0.8%

    Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed mu…

  31. 9.2CVE-2025-53620EPSS 0.4%

    @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then …

  32. 8.7CVE-2025-53366EPSS 9.8%

    The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, result…

  33. 8.7CVE-2025-53365EPSS 0.4%

    The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead t…

  34. 7.1CVE-2025-44019EPSS 0.5%

    AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service. Depending on the t…

  35. 7.1CVE-2025-36539EPSS 0.4%

    AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service.

  36. 6.2CVE-2025-48907EPSS 0.1%

    Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.

  37. 8.7CVE-2025-48997EPSS 0.5%

    Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file…

  38. 7.5CVE-2025-29785EPSS 0.5%

    quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, t…

  39. 6.5CVE-2025-48943EPSS 0.5%

    vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured…

  40. 6.5CVE-2025-48942EPSS 0.6%

    vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability …

  41. 7.5CVE-2025-47944EPSS 0.8%

    Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed mu…

  42. 7.5CVE-2025-23166EPSS 0.8%

    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untruste…

  43. 6.8CVE-2025-20054EPSS 0.2%

    Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.

  44. 7.5CVE-2024-52903EPSS 0.4%

    IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

  45. 7.5CVE-2025-3891EPSS 1.6%

    A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The serve…

  46. 8.7CVE-2025-43855EPSS 0.4%

    tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebS…

  47. 6.5CVE-2025-32944EPSS 0.6%

    The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.  If user import is enabled (which is the default setting), any registered user can upload an archive for importing. Th…

  48. 5.3CVE-2024-49705EPSS 0.3%

    Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent reques…

  49. 7.5CVE-2025-20664EPSS 0.5%

    In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed…

  50. 7.5CVE-2025-20663EPSS 0.5%

    In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed…