# CWE-248.

Every Advisory and CVE whose sources give the weakness CWE-248, newest first.

## Records, newest first (an older page)

- [Server DoS via JavaScript preprocessing or script items](https://agentprime.io/advisories/CVE-2026-23938.md)
  `CVE-2026-23938` · CVE record: Zabbix Zabbix · CVSS 2.1 Low · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-248
- [Uncaught Exception in Kibana Cases Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49096.md)
  `CVE-2026-49096` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-248
- [Uncaught Exception in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72660.md)
  `CVE-2026-72660` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-248
- [SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)](https://agentprime.io/advisories/GHSA-pfvm-w89x-94jw.md)
  `GHSA-pfvm-w89x-94jw` · NuGet `SIPSorcery`: affected `>=10.0.5, <10.0.14`, fixed in `10.0.14` · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-248, CWE-755
- [Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid](https://agentprime.io/advisories/CVE-2026-18675.md)
  `CVE-2026-18675` · CVE record: Kong Inc. Kong Mesh · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-248, CWE-704
- [Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-9mr8-pwpw-3j2w.md)
  `GHSA-9mr8-pwpw-3j2w`, `BIT-dotnet-2026-62909`, `BIT-dotnet-sdk-2026-62909`, `CVE-2026-62909` · NuGet `Microsoft.NETCore.App.Runtime.linux-arm` and 7 more: affected `>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11`, fixed in `8.0.30`, `9.0.19`, `10.0.11` · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-248, CWE-252
- [Intel(R) TDX modules: Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a…](https://agentprime.io/advisories/CVE-2026-20775.md)
  `CVE-2026-20775` · CVE record: Intel(R) TDX modules · CVSS 6.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-248
- [rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic](https://agentprime.io/advisories/GHSA-3x6r-wxxg-53vv.md)
  `GHSA-3x6r-wxxg-53vv`, `BIT-rclone-2026-79778`, `CVE-2026-79778`, `GO-2026-6183` · Go `github.com/rclone/rclone`: affected `<1.75.0`, fixed in `1.75.0` · CVSS 6.0 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Memory corruption, CWE-248
- [undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives](https://agentprime.io/advisories/GHSA-4cwx-7wf7-3272.md)
  `GHSA-4cwx-7wf7-3272`, `CVE-2026-13697` · npm `undici`: affected `>=7.0.0, <7.29.0 || >=8.0.0, <8.9.0`, fixed in `7.29.0`, `8.9.0` · CVSS 7.4 High · Not analysed yet · Published 3 Aug 2026 · Tags: Information disclosure, CWE-248, CWE-525
- [Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message](https://agentprime.io/advisories/GHSA-wg4g-wm44-ch5j.md)
  `GHSA-wg4g-wm44-ch5j`, `CVE-2026-54908`, `GO-2026-6165` · Go `github.com/pion/dtls/v3`: affected `<3.1.4`, fixed in `3.1.4` · CVSS 6.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Memory corruption, CWE-248
- [Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests](https://agentprime.io/advisories/GHSA-68cj-mvg9-rgm2.md)
  `GHSA-68cj-mvg9-rgm2`, `CVE-2026-65834`, `GO-2026-6155` · Go `github.com/projectcapsule/capsule`: affected `<0.13.8`, fixed in `0.13.8` · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-20, CWE-248
- [Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service](https://agentprime.io/advisories/GHSA-ghrq-5wpp-hxx5.md)
  `GHSA-ghrq-5wpp-hxx5`, `CVE-2026-52856`, `GO-2026-6156` · Go `github.com/pterodactyl/wings`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service, CWE-20, CWE-129, CWE-248
- [SvelteKit: Big remote form function payloads can cause Node process to crash](https://agentprime.io/advisories/GHSA-wqjv-9729-c5q2.md)
  `GHSA-wqjv-9729-c5q2`, `CVE-2026-82256` · npm `@sveltejs/kit`: affected `<2.69.1`, fixed in `2.69.1` · CVSS 6.9 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, CWE-248
- [find-my-way: DDoS with HTTP2](https://agentprime.io/advisories/GHSA-c96f-x56v-gq3h.md)
  `GHSA-c96f-x56v-gq3h`, `CVE-2026-47219` · npm `find-my-way`: affected `<9.7.0`, fixed in `9.7.0` · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Prototype pollution, CWE-20, CWE-248
- [Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers](https://agentprime.io/advisories/GHSA-xmf8-cvqr-rfgj.md)
  `GHSA-xmf8-cvqr-rfgj`, `CVE-2026-73418` · npm `@auth/core` and 1 more: affected `>=0.1.0, <0.41.3`, fixed in `0.41.3` · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-20, CWE-248
- [gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities](https://agentprime.io/advisories/GHSA-hrxh-6v49-42gf.md)
  `GHSA-hrxh-6v49-42gf`, `GO-2026-6061` · Go `google.golang.org/grpc`: affected `<1.82.1`, fixed in `1.82.1` · CVSS 4.0, no score published · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service, Broken access control, CWE-248
- [OpenTelemetry JavaScript: Denial of service in \`JaegerPropagator\` via unhandled exception on a malformed header](https://agentprime.io/advisories/GHSA-45rx-2jwx-cxfr.md)
  `GHSA-45rx-2jwx-cxfr`, `CVE-2026-59892` · npm `@opentelemetry/propagator-jaeger`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-248
- [websocket-driver-ruby: Denial of service via malformed Host header](https://agentprime.io/advisories/GHSA-2x63-gw47-w4mm.md)
  `GHSA-2x63-gw47-w4mm`, `CVE-2026-61666` · RubyGems `websocket-driver`: affected `<0.8.2`, fixed in `0.8.2` · CVSS 8.9 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-248
- [webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header](https://agentprime.io/advisories/GHSA-m28w-2pqf-7qgj.md)
  `GHSA-m28w-2pqf-7qgj`, `CVE-2026-14631` · npm `webpack-dev-server`: affected `<5.2.6`, fixed in `5.2.6` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-20, CWE-248
- [node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records](https://agentprime.io/advisories/GHSA-gvwx-54wh-qm9j.md)
  `GHSA-gvwx-54wh-qm9j`, `CVE-2026-59875` · npm `tar`: affected `<7.5.17`, fixed in `7.5.17` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-248
- [Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png](https://agentprime.io/advisories/CVE-2026-64612.md)
  `CVE-2026-64612` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-248
- [Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB](https://agentprime.io/advisories/GHSA-f7q6-7rq9-3phx.md)
  `GHSA-f7q6-7rq9-3phx` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 18 Jul 2026 · Tags: CWE-248
- [Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role](https://agentprime.io/advisories/GHSA-9qrf-6whp-92w3.md)
  `GHSA-9qrf-6whp-92w3` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 4.9 Medium · Withdrawn · Not analysed yet · Published 18 Jul 2026 · Tags: CWE-248
- [Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist](https://agentprime.io/advisories/GHSA-9qjc-q7hw-vw5r.md)
  `GHSA-9qjc-q7hw-vw5r` · crates.io `surrealdb`: affected `<=1.1.1`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 18 Jul 2026 · Tags: CWE-248
- [ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes](https://agentprime.io/advisories/GHSA-g77h-45rf-hcx4.md)
  `GHSA-g77h-45rf-hcx4`, `CVE-2026-53496` · npm `exifreader`: affected `<4.40.1`, fixed in `4.40.1` · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-248, CWE-755
- [nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys](https://agentprime.io/advisories/GHSA-46wq-28cx-mhw4.md)
  `GHSA-46wq-28cx-mhw4`, `CVE-2026-54541` · crates.io `nimiq-primitives`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 3.7 Low · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-248
- [NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can…](https://agentprime.io/advisories/CVE-2026-47480.md)
  `CVE-2026-47480` · CVE record: NVIDIA Triton Inference Server · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-248
- [Windows Server Update Service (WSUS) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-50328.md)
  `CVE-2026-50328` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-20, CWE-248
- [NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size](https://agentprime.io/advisories/CVE-2026-55780.md)
  `CVE-2026-55780` · CVE record: M2Team NanaZip · CVSS 2.4 Low · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service, CWE-248
- [NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled](https://agentprime.io/advisories/CVE-2026-58208.md)
  `CVE-2026-58208` · CVE record: nats-io nats-server · CVSS 6.8 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-248
- [ratex-parser panics on \`\verb\` with a multibyte delimiter (UTF-8 byte-boundary slice)](https://agentprime.io/advisories/GHSA-4hgp-59h5-gvrj.md)
  `GHSA-4hgp-59h5-gvrj`, `CVE-2026-53530` · crates.io `ratex-parser`: affected `<0.1.11`, fixed in `0.1.11` · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Denial of service, CWE-248, CWE-1285
- [Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific re…](https://agentprime.io/advisories/CVE-2026-27844.md)
  `CVE-2026-27844` · CVE record: Gallagher Controller 7000 and 6000 · CVSS 2.7 Low · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-248
- [Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service.](https://agentprime.io/advisories/CVE-2026-27790.md)
  `CVE-2026-27790` · CVE record: Gallagher T-20 Readers · CVSS 2.7 Low · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-248
- [Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection](https://agentprime.io/advisories/GHSA-hhm7-qrv5-h4r6.md)
  `GHSA-hhm7-qrv5-h4r6`, `CVE-2026-52739` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 5.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-248
- [Zebra: Finalized address balance credit-first overflow on consensus-valid blocks](https://agentprime.io/advisories/GHSA-w834-cf6p-9m9w.md)
  `GHSA-w834-cf6p-9m9w`, `CVE-2026-52738` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 6.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-248
- [zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers](https://agentprime.io/advisories/GHSA-c8w6-x74f-vmg3.md)
  `GHSA-c8w6-x74f-vmg3`, `CVE-2026-104434` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service, CWE-20, CWE-248, CWE-754
- [zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate](https://agentprime.io/advisories/GHSA-qv2r-v3mx-f4pf.md)
  `GHSA-qv2r-v3mx-f4pf`, `CVE-2026-52731` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-248
- [SurrealDB has unauthenticated remote DoS via malformed RPC \`use\` call](https://agentprime.io/advisories/GHSA-wjjj-24cx-f28g.md)
  `GHSA-wjjj-24cx-f28g`, `CVE-2026-63747` · crates.io `surrealdb`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-248, CWE-754
- [@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths](https://agentprime.io/advisories/CVE-2026-14181.md)
  `CVE-2026-14181` · CVE record: @fastify/middie @fastify/middie · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-248
- [Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER](https://agentprime.io/advisories/CVE-2026-50129.md)
  `CVE-2026-50129` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-248
- [CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.](https://agentprime.io/advisories/GHSA-m744-jhq9-ppw6.md)
  `GHSA-m744-jhq9-ppw6`, `CVE-2026-54775` · NuGet `CoreWCF.Kafka`: affected `<1.8.1 || >=1.9.0, <1.9.1`, fixed in `1.8.1`, `1.9.1` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-248, CWE-754, CWE-755
- [ts-deepmerge: Prototype Method Override leads to DoS](https://agentprime.io/advisories/GHSA-87mf-gv2c-c62c.md)
  `GHSA-87mf-gv2c-c62c`, `CVE-2026-12644` · npm `ts-deepmerge`: affected `<8.0.0`, fixed in `8.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-248
- [Deno: Denial of service via non-ASCII bytes in WebSocket response headers](https://agentprime.io/advisories/GHSA-x2qc-cmh9-f4hf.md)
  `GHSA-x2qc-cmh9-f4hf`, `CVE-2026-55517` · crates.io `deno`: affected `<2.7.5`, fixed in `2.7.5` · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-248
- [@grpc/grpc-js: A malformed request can cause a server crash](https://agentprime.io/advisories/GHSA-5375-pq7m-f5r2.md)
  `GHSA-5375-pq7m-f5r2`, `CVE-2026-48068` · npm `@grpc/grpc-js`: affected `<1.9.16 || >=1.10.0, <1.10.12 || >=1.11.0, <1.11.4 || >=1.12.0, <1.12.7 || >=1.13.0, <1.13.5 || >=1.14.0, <1.14.4`, fixed in `1.9.16`, `1.10.12`, `1.11.4`, `1.12.7`, `1.13.5`, `1.14.4` · CVSS 7.5 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-248
- [@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash](https://agentprime.io/advisories/GHSA-99f4-grh7-6pcq.md)
  `GHSA-99f4-grh7-6pcq`, `CVE-2026-48069` · npm `@grpc/grpc-js`: affected `<1.9.16 || >=1.10.0, <1.10.12 || >=1.11.0, <1.11.4 || >=1.12.0, <1.12.7 || >=1.13.0, <1.13.5 || >=1.14.0, <1.14.4`, fixed in `1.9.16`, `1.10.12`, `1.11.4`, `1.12.7`, `1.13.5`, `1.14.4` · CVSS 7.5 High · Not analysed yet · Published 11 Jun 2026 · Tags: Denial of service, CWE-248
- [joi has an uncaught RangeError on deeply nested input through recursive \`link()\` schemas](https://agentprime.io/advisories/GHSA-q7cg-457f-vx79.md)
  `GHSA-q7cg-457f-vx79`, `CVE-2026-48038` · npm `joi`: affected `<17.13.4 || >=18.0.0, <18.2.1`, fixed in `17.13.4`, `18.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Denial of service, CWE-248
- [FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older](https://agentprime.io/advisories/CVE-2026-46411.md)
  `CVE-2026-46411` · CVE record: halfgaar FlashMQ · CVSS 6.5 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-248
- [Uncaught exception vulnerability in Suprema's BioStar](https://agentprime.io/advisories/CVE-2026-9509.md)
  `CVE-2026-9509` · CVE record: Suprema BioStar 2 (server) · CVSS 8.7 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-248
- [IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date](https://agentprime.io/advisories/CVE-2025-15649.md)
  `CVE-2025-15649` · CVE record: PMQS IO::Uncompress::Unzip · CVSS 5.5 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-248
- [Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification](https://agentprime.io/advisories/CVE-2026-44905.md)
  `CVE-2026-44905` · CVE record: riebl vanetza · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-248
- [Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing](https://agentprime.io/advisories/CVE-2026-43988.md)
  `CVE-2026-43988` · CVE record: riebl vanetza · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-248
- [nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item](https://agentprime.io/advisories/GHSA-mw3q-r9wh-h2ff.md)
  `GHSA-mw3q-r9wh-h2ff`, `CVE-2026-46545` · crates.io `nimiq-primitives`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 7.5 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-248
- [NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes](https://agentprime.io/advisories/GHSA-pq7c-x8g4-rvp6.md)
  `GHSA-pq7c-x8g4-rvp6`, `CVE-2026-45554`, `PYSEC-2026-2680` · PyPI `nicegui`: affected `<3.12.0`, fixed in `3.12.0` · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: Denial of service, CWE-248
- [OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages](https://agentprime.io/advisories/GHSA-j8p6-96vp-f3r9.md)
  `GHSA-j8p6-96vp-f3r9`, `CVE-2026-45685`, `GO-2026-5456` · Go `go.opentelemetry.io/obi`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 7.5 High · Not analysed yet · Published 18 May 2026 · Tags: CWE-20, CWE-248, CWE-704
- [OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent](https://agentprime.io/advisories/GHSA-wp73-mwgf-4jq9.md)
  `GHSA-wp73-mwgf-4jq9`, `CVE-2026-45676`, `GO-2026-5714` · Go `go.opentelemetry.io/obi`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 5.5 Medium · Not analysed yet · Published 18 May 2026 · Tags: CWE-20, CWE-248
- [multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception](https://agentprime.io/advisories/GHSA-qxch-whhj-8956.md)
  `GHSA-qxch-whhj-8956`, `CVE-2026-8161` · npm `multiparty`: affected `<4.3.0`, fixed in `4.3.0` · CVSS 7.5 High · Not analysed yet · Published 18 May 2026 · Tags: Prototype pollution, CWE-248
- [ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators](https://agentprime.io/advisories/CVE-2026-42268.md)
  `CVE-2026-42268` · CVE record: owasp-modsecurity ModSecurity · CVSS 8.2 High · Not analysed yet · Published 12 May 2026 · Tags: Memory corruption, CWE-248
- [vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)](https://agentprime.io/advisories/GHSA-hw58-p9xv-2mjh.md)
  `GHSA-hw58-p9xv-2mjh`, `CVE-2026-44001` · npm `vm2`: affected `<3.11.0`, fixed in `3.11.0` · CVSS 8.6 High · Not analysed yet · Published 7 May 2026 · Tags: CWE-248
- [scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion](https://agentprime.io/advisories/GHSA-r5fr-9gmv-jggh.md)
  `GHSA-r5fr-9gmv-jggh`, `CVE-2026-46689` · crates.io `kanidm_proto` and 1 more: affected `<1.9.3`, fixed in `1.9.3` · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: Denial of service, CWE-248
- [Granian vulnerable to DoS via WSGI response header panic](https://agentprime.io/advisories/GHSA-f5p7-9fr5-8jmj.md)
  `GHSA-f5p7-9fr5-8jmj`, `CVE-2026-42545`, `PYSEC-2026-2502` · PyPI `granian`: affected `>=0.2.0, <2.7.4`, fixed in `2.7.4` · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-248, CWE-755

Newest: <https://agentprime.io/advisories/tag/cwe-248.md>
Older: <https://agentprime.io/advisories/tag/cwe-248.md?cursor=WyIyMDI2LTA1LTA2VDIxOjI0OjU2LjAwMDAwMFoiLCJHSFNBLWY1cDctOWZyNS04am1qIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-248&cursor=WyIyMDI2LTA4LTIwVDE3OjI4OjUyLjAwMDAwMFoiLCJHSFNBLTg5djgtcmh3cS1oZjc3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-248/?cursor=WyIyMDI2LTA4LTIwVDE3OjI4OjUyLjAwMDAwMFoiLCJHSFNBLTg5djgtcmh3cS1oZjc3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.