# CWE-248.

Every Advisory and CVE whose sources give the weakness CWE-248, newest first.

## Records, newest first (an older page)

- [vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process](https://agentprime.io/advisories/GHSA-gjq8-xm47-88rc.md)
  `GHSA-gjq8-xm47-88rc`, `CVE-2026-92954` · npm `vm2`: affected `>=3.10.0, <3.11.8`, fixed in `3.11.8` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-248, CWE-703
- [In multiple places, there is a possible denial of service due to an uncaught exception.](https://agentprime.io/advisories/CVE-2026-58859.md)
  `CVE-2026-58859` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-248
- [Apache Thrift: Perl servers end \`serve()\` when serving one connection fails](https://agentprime.io/advisories/CVE-2026-96286.md)
  `CVE-2026-96286` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248
- [Apache Thrift: Ruby \`SimpleServer\` ends \`serve()\` on any non-Transport/Protocol exception](https://agentprime.io/advisories/CVE-2026-96277.md)
  `CVE-2026-96277` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248, CWE-755
- [Apache Thrift: Node.js \`server.js\` ends the process on any per-connection error (+ two triggers)](https://agentprime.io/advisories/CVE-2026-94646.md)
  `CVE-2026-94646` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Prototype pollution, CWE-248, CWE-1284
- [Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service](https://agentprime.io/advisories/CVE-2026-90440.md)
  `CVE-2026-90440` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-248, CWE-755
- [Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service](https://agentprime.io/advisories/CVE-2026-86537.md)
  `CVE-2026-86537` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, Denial of service, CWE-248
- [Apache Thrift: nodejs web server: no \`error\` listener on an upgraded WebSocket connection](https://agentprime.io/advisories/CVE-2026-96294.md)
  `CVE-2026-96294` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248, CWE-755
- [Apache Thrift: PHP \`TSimpleServer\` exits the whole process on any non-transport exception](https://agentprime.io/advisories/CVE-2026-94642.md)
  `CVE-2026-94642` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-248
- [Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)](https://agentprime.io/advisories/CVE-2026-85493.md)
  `CVE-2026-85493` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-248
- [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…](https://agentprime.io/advisories/CVE-2026-85494.md)
  `CVE-2026-85494` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-130, CWE-248, CWE-1188
- [Apache Thrift: Java \`TSaslNonblockingServer\`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)](https://agentprime.io/advisories/CVE-2026-94639.md)
  `CVE-2026-94639` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-248, CWE-755
- [devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise](https://agentprime.io/advisories/GHSA-x5rw-q4pp-hg5g.md)
  `GHSA-x5rw-q4pp-hg5g` · npm `devalue`: affected `>=5.8.0, <5.9.3`, fixed in `5.9.3` · CVSS 4.0, no score published · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-248, CWE-755
- [fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses](https://agentprime.io/advisories/GHSA-4mh8-r7rc-xpvc.md)
  `GHSA-4mh8-r7rc-xpvc`, `CVE-2026-92081` · npm `fastify`: affected `<5.12.5`, fixed in `5.12.5` · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-248
- [Astro: Malformed port in the Host header can crash the Node adapter](https://agentprime.io/advisories/GHSA-qh8j-hqjv-7m4x.md)
  `GHSA-qh8j-hqjv-7m4x`, `CVE-2026-102984` · npm `@astrojs/node`: affected `<11.1.3`, fixed in `11.1.3` · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-248
- [garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception](https://agentprime.io/advisories/CVE-2026-103387.md)
  `CVE-2026-103387` · CVE record: garycourt uri-js · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-248
- [PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)](https://agentprime.io/advisories/GHSA-42vr-xj54-vc7v.md)
  `GHSA-42vr-xj54-vc7v`, `CVE-2026-101918`, `PYSEC-2026-4141` · PyPI `pyjwt`: affected `>=2.0.0a1, <2.15.0`, fixed in `2.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-248
- [Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them](https://agentprime.io/advisories/CVE-2026-102511.md)
  `CVE-2026-102511` · CVE record: Apache Software Foundation Apache PLC4X · CVSS 8.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Denial of service, CWE-129, CWE-248, CWE-940
- [Nest: Remote process termination via a deeply nested microservice message pattern](https://agentprime.io/advisories/GHSA-m8vh-jmq9-5rjg.md)
  `GHSA-m8vh-jmq9-5rjg`, `CVE-2026-102281` · npm `@nestjs/microservices`: affected `<11.2.4 || >=12.0.0, <12.0.2`, fixed in `11.2.4`, `12.0.2` · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service, CWE-248
- [Socket.IO: Engine.IO Protocol Revision Mismatch DoS](https://agentprime.io/advisories/GHSA-2gc4-cqfq-p2gv.md)
  `GHSA-2gc4-cqfq-p2gv`, `CVE-2026-102599` · npm `engine.io`: affected `>=6.6.0, <6.6.10`, fixed in `6.6.10` · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-248
- [adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)](https://agentprime.io/advisories/GHSA-8238-w5pm-2374.md)
  `GHSA-8238-w5pm-2374`, `CVE-2026-114102` · npm `adm-zip`: affected `<0.6.1`, fixed in `0.6.1` · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service, CWE-248
- [Uncaught exception in Baicells Nova 430H](https://agentprime.io/advisories/CVE-2026-96274.md)
  `CVE-2026-96274` · CVE record: Baicells Nova 430H eNodeB (model pBS3101SH) · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-248
- [undici vulnerable to Denial of Service via unrequested WebSocket subprotocol](https://agentprime.io/advisories/GHSA-rfgv-xxqx-mfg5.md)
  `GHSA-rfgv-xxqx-mfg5`, `CVE-2026-19534` · npm `undici`: affected `>=6.7.0, <6.28.1 || >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2`, fixed in `6.28.1`, `7.29.1`, `8.10.2` · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-248, CWE-252
- [undici vulnerable to response truncation via oversized chunked responses in the dump interceptor](https://agentprime.io/advisories/GHSA-2gqq-gqf2-x968.md)
  `GHSA-2gqq-gqf2-x968`, `CVE-2026-84947` · npm `undici`: affected `>=7.1.0, <7.29.1 || >=8.0.0, <8.10.2`, fixed in `7.29.1`, `8.10.2` · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-20, CWE-248
- [undici vulnerable to Denial of Service via WebSocketStream unclean close](https://agentprime.io/advisories/GHSA-rx4f-c7p8-82vq.md)
  `GHSA-rx4f-c7p8-82vq`, `CVE-2026-85014` · npm `undici`: affected `>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2`, fixed in `7.29.1`, `8.10.2` · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-248, CWE-754
- [undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression](https://agentprime.io/advisories/GHSA-3wwx-pv8p-q78v.md)
  `GHSA-3wwx-pv8p-q78v`, `CVE-2026-85024` · npm `undici`: affected `>=6.25.0, <6.28.1 || >=7.28.0, <7.29.1 || >=8.1.0, <8.10.2`, fixed in `6.28.1`, `7.29.1`, `8.10.2` · CVSS 5.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-248
- [ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception](https://agentprime.io/advisories/CVE-2026-101101.md)
  `CVE-2026-101101` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-248
- [aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception](https://agentprime.io/advisories/CVE-2026-101035.md)
  `CVE-2026-101035` · CVE record: aligungr UERANSIM · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-248
- [Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process](https://agentprime.io/advisories/GHSA-7rr2-8fr3-fjqx.md)
  `GHSA-7rr2-8fr3-fjqx` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 6.8 Medium · Withdrawn · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-248
- [stoatchat before 0.15.5 Denial of Service via mass mentions](https://agentprime.io/advisories/CVE-2026-100675.md)
  `CVE-2026-100675` · CVE record: stoatchat stoatchat · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-248
- [Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10](https://agentprime.io/advisories/CVE-2026-92608.md)
  `CVE-2026-92608` · CVE record: Apache Software Foundation Apache Qpid Broker-J · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-248
- [Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-92905.md)
  `CVE-2026-92905` · CVE record: Zohocorp ManageEngine EventLog Analyzer and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-248
- [Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug](https://agentprime.io/advisories/GHSA-5f42-97gr-vfhq.md)
  `GHSA-5f42-97gr-vfhq`, `CVE-2026-85724`, `CVE-2026-95842`, `CVE-2026-95843`, `CVE-2026-95844`, `CVE-2026-95845`, `CVE-2026-95846`, `CVE-2026-95847`, `CVE-2026-95848` · Maven `io.moquette:moquette-broker`: affected `<0.18.1`, fixed in `0.18.1` · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service, Broken access control, CWE-20, CWE-99
- [request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process](https://agentprime.io/advisories/GHSA-r3r9-wp5j-pq5g.md)
  `GHSA-r3r9-wp5j-pq5g`, `CVE-2026-62985` · npm `request-filtering-agent`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-248
- [vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incom...](https://agentprime.io/advisories/PYSEC-2026-4004.md)
  `PYSEC-2026-4004`, `CVE-2026-94622` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-248
- [Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.](https://agentprime.io/advisories/CVE-2026-88411.md)
  `CVE-2026-88411` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-248
- [Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware](https://agentprime.io/advisories/CVE-2026-32641.md)
  `CVE-2026-32641` · CVE record: parseablehq parseable · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-248, CWE-703
- [Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process](https://agentprime.io/advisories/GHSA-mgj2-jqjq-q8gg.md)
  `GHSA-mgj2-jqjq-q8gg` · npm `vm2`: affected `>=3.10.0, <=3.11.7`, no fixed version yet · CVSS 8.6 High · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-248
- [Pocketbase: Unhandled panic in worker goroutines](https://agentprime.io/advisories/GHSA-84vh-m24q-wjjx.md)
  `GHSA-84vh-m24q-wjjx`, `CVE-2026-82410`, `GO-2026-6489` · Go `github.com/pocketbase/pocketbase`: affected `<0.22.48 || >=0.23.0, <0.39.7`, fixed in `0.22.48`, `0.39.7` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-248
- [Panic via negative shared-string index in github.com/xuri/excelize](https://agentprime.io/advisories/GHSA-fx5j-qcqg-grpf.md)
  `GHSA-fx5j-qcqg-grpf`, `CVE-2026-59162`, `GO-2026-6452` · Go `github.com/xuri/excelize/v2`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-248, CWE-755
- [libp2p-quic: Remote panic via certificate expiry race during QUIC handshake](https://agentprime.io/advisories/GHSA-5hq8-qhww-jm7q.md)
  `GHSA-5hq8-qhww-jm7q`, `CVE-2026-61544` · crates.io `libp2p-quic`: affected `<0.13.1`, fixed in `0.13.1` · CVSS 8.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-248
- [Server panic via missing authority or Host headers in google.golang.org/grpc](https://agentprime.io/advisories/GHSA-2v4p-qf9q-27wj.md)
  `GHSA-2v4p-qf9q-27wj`, `CVE-2026-84445`, `GO-2026-6443` · Go `google.golang.org/grpc`: affected `<1.82.2 || >=1.83.0, <1.83.2 || >=1.84.0-dev, <1.84.0-dev.0.20260825144003-d5a41119e0e3 || >=1.85.0-dev, <1.85.0-dev.0.20260825072537-93e31b48545e`, fixed in `1.82.2`, `1.83.2`, `1.84.0-dev.0.20260825144003-d5a41119e0e3`, `1.85.0-dev.0.20260825072537-93e31b48545e` · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-129, CWE-248
- [Uncontrolled resource consumption in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65410.md)
  `CVE-2026-65410` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, CWE-248
- [hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping](https://agentprime.io/advisories/CVE-2026-87123.md)
  `CVE-2026-87123` · CVE record: hbs hbs · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-248
- [rclone local: crafted Range request against a translated symlink panics (DoS)](https://agentprime.io/advisories/GHSA-p6m2-r3w9-mpxw.md)
  `GHSA-p6m2-r3w9-mpxw`, `BIT-rclone-2026-88015`, `CVE-2026-88015`, `GO-2026-6461` · Go `github.com/rclone/rclone`: affected `<1.75.1`, fixed in `1.75.1` · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Memory corruption, CWE-248
- [SQLAdmin: Unvalidated sortBy parameter in \`ModelView\` bypasses \`column_sortable_list\`](https://agentprime.io/advisories/GHSA-ccg5-9c8w-xh6v.md)
  `GHSA-ccg5-9c8w-xh6v`, `CVE-2026-54529`, `PYSEC-2026-3922` · PyPI `sqladmin`: affected `<0.27.1`, fixed in `0.27.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-20, CWE-248
- [multer vulnerable to Denial of Service via crafted multipart field names](https://agentprime.io/advisories/GHSA-wc9g-mqfw-jrwm.md)
  `GHSA-wc9g-mqfw-jrwm`, `CVE-2026-77078` · npm `multer`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-248
- [Windows iSCSI Target Service Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-69839.md)
  `CVE-2026-69839` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-248
- [Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82058.md)
  `CVE-2026-82058` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-248
- [qs: Denial of Service via Attacker Controlled isBuffer](https://agentprime.io/advisories/GHSA-4mjr-xmp4-gh2g.md)
  `GHSA-4mjr-xmp4-gh2g`, `CVE-2026-82417` · npm `qs`: affected `>=2.2.5, <6.16.0`, fixed in `6.16.0` · CVSS 6.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-248, CWE-703
- [Uncaught Exception in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72644.md)
  `CVE-2026-72644` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-248
- [Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)](https://agentprime.io/advisories/GHSA-73wf-gq98-2v4g.md)
  `GHSA-73wf-gq98-2v4g`, `CVE-2026-73088` · npm `browserslist`: affected `<4.28.7`, fixed in `4.28.7` · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Prototype pollution, CWE-248
- [MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service](https://agentprime.io/advisories/CVE-2026-81517.md)
  `CVE-2026-81517` · CVE record: MongoDB BI Connector · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-248
- [alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server](https://agentprime.io/advisories/GHSA-hr6j-w4mw-g9mj.md)
  `GHSA-hr6j-w4mw-g9mj`, `CVE-2026-55484`, `GO-2026-6321` · Go `github.com/guno1928/alos-http`: affected `<0.0.0-20260617230736-314b6783e196`, fixed in `0.0.0-20260617230736-314b6783e196` · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-248, CWE-754
- [Starlette-Admin's unvalidated \`order_by\` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS](https://agentprime.io/advisories/GHSA-6753-gr46-6wpr.md)
  `GHSA-6753-gr46-6wpr`, `CVE-2026-54553`, `PYSEC-2026-3924` · PyPI `starlette-admin`: affected `<0.16.1`, fixed in `0.16.1` · CVSS 5.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Information disclosure, Broken access control, CWE-248, CWE-602
- [Faktory: Unrecovered panic in command handlers allows full-server denial of service](https://agentprime.io/advisories/CVE-2026-63403.md)
  `CVE-2026-63403` · CVE record: contribsys faktory · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-248
- [postgres-protocol: Panic decoding a malformed \`hstore\` value allows denial of service](https://agentprime.io/advisories/GHSA-rgqc-3x5p-6gwg.md)
  `GHSA-rgqc-3x5p-6gwg`, `RUSTSEC-2026-0180` · crates.io `postgres-protocol`: affected `<0.6.12`, fixed in `0.6.12` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-20, CWE-248
- [Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys](https://agentprime.io/advisories/CVE-2026-77781.md)
  `CVE-2026-77781` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-248
- [netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash](https://agentprime.io/advisories/GHSA-pgrf-4654-3gq8.md)
  `GHSA-pgrf-4654-3gq8`, `CVE-2026-61799` · Maven `io.netty.incubator:netty-incubator-codec-bhttp`: affected `<0.0.23.Final`, fixed in `0.0.23.Final` · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption, CWE-248, CWE-681
- [asteval has a Sandbox Escape via BaseException Subclasses](https://agentprime.io/advisories/GHSA-89v8-rhwq-hf77.md)
  `GHSA-89v8-rhwq-hf77`, `CVE-2026-55244`, `PYSEC-2026-3807` · PyPI `asteval`: affected `<1.0.9`, fixed in `1.0.9` · CVSS 5.0 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-248

Newest: <https://agentprime.io/advisories/tag/cwe-248.md>
Older: <https://agentprime.io/advisories/tag/cwe-248.md?cursor=WyIyMDI2LTA4LTIwVDE3OjI4OjUyLjAwMDAwMFoiLCJHSFNBLTg5djgtcmh3cS1oZjc3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-248&cursor=WyIyMDI2LTEwLTA1VDIzOjE5OjU1LjAwMDAwMFoiLCJHSFNBLTJ2MnAtNmo5Ny1jamc5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-248/?cursor=WyIyMDI2LTEwLTA1VDIzOjE5OjU1LjAwMDAwMFoiLCJHSFNBLTJ2MnAtNmo5Ny1jamc5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.