CWE-248.

Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic

• Denial of service
• CWE-20

>=1.2.0, <2.7.4 · fixed in 2.7.4

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

• Denial of service
• CWE-248

<0.69.0 · fixed in 0.69.0

An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service.

• CWE-248

aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception

• aligungr UERANSIM
• CWE-248

Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability

• Foxit Software Inc. Foxit PDF Editor
• Foxit Software Inc. Foxit PDF Reader
• CWE-248

uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths

• CWE-248

<=0.8.0 · no fixed version yet

Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

• Denial of service
• CWE-248

>=2.2.0, <4.3.1 · fixed in 4.3.1

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

• CWE-248

>=0.0.0-0, <24.0.7 || >=25.0.0, <36.0.7 || >=37.0.0, <42.0.2 || >=43.0.0, <43.0.1 · fixed in 24.0.7, 36.0.7, 42.0.2, 43.0.1

Panic when lifting `flags` component value

• CWE-248

>=0.0.0-0, <24.0.7 || >=25.0.0, <36.0.7 || >=37.0.0, <42.0.2 || >=43.0.0, <43.0.1 · fixed in 24.0.7, 36.0.7, 42.0.2, 43.0.1

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

• CWE-20
• CWE-248

<1.7.8 · fixed in 1.7.8

NVIDIA Triton Inference Server: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a…

• NVIDIA Triton Inference Server
• CWE-248

Go JOSE Panics in JWE decryption

• Memory corruption
• CWE-248

<=2.6.3 · no fixed version yet

Haraka affected by DoS via `__proto__` email header

• CWE-248

<3.1.4 · fixed in 3.1.4

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

• CWE-248
• CWE-754

>=4.0.0, <4.7.9 · fixed in 4.7.9

free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

• CWE-158
• CWE-248

<1.4.2 · fixed in 1.4.2

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

• Authentication bypass
• CWE-248

<3.6.2 · fixed in 3.6.2

Parse Server LiveQuery subscription with invalid regular expression crashes server

• CWE-248

<8.6.43 || >=9.0.0, <9.6.0-alpha.19 · fixed in 8.6.43, 9.6.0-alpha.19

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

• CWE-248
• CWE-1284

<6.24.0 || >=7.0.0, <7.24.0 · fixed in 6.24.0, 7.24.0

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

• CWE-248
• CWE-1284

>=6.0.0, <6.24.0 || >=7.0.0, <7.24.0 · fixed in 6.24.0, 7.24.0

Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

• Denial of service
• CWE-248

<0.13.10 · fixed in 0.13.10

LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos

• danny-avila LibreChat
• CWE-248

cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header

• yhirose cpp-httplib
• CWE-248

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

• CWE-248

<0.11.14 · fixed in 0.11.14

Python-Markdown has an Uncaught Exception

• Denial of service
• CWE-248

<3.8.1 · fixed in 3.8.1

Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability

• Cisco Cyber Vision
• Cisco Secure Firewall Threat Defense (FTD) Software
• CWE-248

ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability

• Cisco Secure Endpoint
• CWE-248

Exiv2: Uncaught exception - cannot create std::vector larger than max_size()

• exiv2
• CWE-248

Vikunja has Path Traversal in CLI Restore

• Path traversal
• CWE-248

<=0.24.6 · no fixed version yet

Uncaught Exception vulnerability in AVEVA PI Data Archive

• AVEVA PI Data Archive PI Server
• CWE-248

100GbE Intel(R) Ethernet Controller E810: Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810…

• 100GbE Intel(R) Ethernet Controller E810
• CWE-248

Emmett-Core: Unhandled CookieError Exception Causing Denial of Service

• Authentication bypass
• CWE-248

<1.3.11 · fixed in 1.3.11

A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server.

• Axis Communications AB AXIS Camera Station Pro
• CWE-248

LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic

• CWE-248

>=1.29.3, <1.49.1 · fixed in 1.49.1

[actix-files] Panic triggered by empty Range header in GET request for static file

• CWE-20
• CWE-248

<0.6.10 · fixed in 0.6.10

fast-xml-parser has RangeError DoS Numeric Entities Bug

• CWE-20
• CWE-248

>=5.0.9, <5.3.4 · fixed in 5.3.4

node: We have identified a bug in Node.js error handling where "Maximum call stack size…

• node
• CWE-248

Uncontrolled resource consumption in node

• node
• Denial of service
• CWE-248

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

• Denial of service
• Server-side request forgery (SSRF)

>=5.4.1, <5.5.1 · fixed in 5.5.1

robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation

• CWE-248

<3.1.4 · fixed in 3.1.4

In Modem, there is a possible system crash due to an uncaught exception.

• MediaTek, Inc. MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893
• CWE-248

In Modem, there is a possible system crash due to an incorrect bounds check.

• MediaTek, Inc. MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6878, MT6878M, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8673, MT8675, MT8676, MT8678, MT8755, MT8771, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893
• CWE-248

In Modem, there is a possible system crash due to an uncaught exception.

• MediaTek, Inc. MT2735, MT2737, MT6833, MT6833P, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6877TT, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6895TT, MT6896, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT8675, MT8771, MT8791, MT8791T, MT8797
• CWE-248

Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

• CWE-248

<1.8.0-beta.27 · fixed in 1.8.0-beta.27

ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range

• Automated Logic WebCtrl
• Automated Logic Gen5 Controllers
• CWE-129
• CWE-248

On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.

• Arista Networks EOS
• CWE-248

Denial of Service - Protocol Manipulation

• Azure Access Technology BLU-IC2
• Azure Access Technology BLU-IC4
• CWE-248

Denial-of-service (DoS) via delayed or missing client response

• SICK AG TLOC100-100 all Firmware versions
• CWE-248

Gallagher Command Centre Server: Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and…

• Gallagher Command Centre Server
• CWE-248

DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

• CWE-248

>=0.0.0-0, <0.8.26 || >=1.0.0, <1.4.1 · fixed in 0.8.26, 1.4.1

Microsoft Office Denial of Service Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office LTSC 2024
• CWE-248

Rockwell Automation Compact GuardLogix® 5370 Denial-Of-Service Vulnerability

• Rockwell Automation Compact GuardLogix® 5370
• CWE-248

Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

• CWE-248
• CWE-703

>=2.9.0-rc1, <2.14.20 · fixed in 2.14.20

A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).

• CWE-248

<2.7.1 · fixed in 2.7.1

A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).

• CWE-248

<2.7.1 · fixed in 2.7.1

CISA Thorium account verification email error handling

• CISA Thorium
• CWE-248

TYPO3 Bookmark Toolbar vulnerable to denial of service

• CWE-248

>=11.0.0, <12.4.37 || >=12.0.0, <12.4.37 || >=13.0.0, <13.4.18 · fixed in 12.4.37, 13.4.18

Uncaught exception issue exists in Multiple products in bizhub series.

• Konica Minolta, Inc. Multiple products in bizhub series
• CWE-248

Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

• Part-DB-server
• CWE-248

Sysax Multi-Server <= 6.10 SSHD Key Exchange DoS

• Sysax Software Multi-Server
• CWE-248

Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service

• CWE-20
• CWE-248

<1.14.2 · fixed in 1.14.2