CWE-248.

Server DoS via JavaScript preprocessing or script items

• Zabbix
• CWE-248

Uncaught Exception in Kibana Cases Leading to Denial of Service

• Elastic Kibana
• CWE-248

Uncaught Exception in Kibana Leading to Denial of Service

• Elastic Kibana
• CWE-248

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

• CWE-248
• CWE-755

>=10.0.5, <10.0.14 · fixed in 10.0.14

Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

• Kong Inc. Kong Mesh
• CWE-248
• CWE-704

Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability

• CWE-248
• CWE-252

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Intel(R) TDX modules: Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a…

• Intel(R) TDX modules
• CWE-248

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

• Memory corruption
• CWE-248

<1.75.0 · fixed in 1.75.0

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

• Information disclosure
• CWE-248

>=7.0.0, <7.29.0 || >=8.0.0, <8.9.0 · fixed in 7.29.0, 8.9.0

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

• Memory corruption
• CWE-248

<3.1.4 · fixed in 3.1.4

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

• CWE-20
• CWE-248

<0.13.8 · fixed in 0.13.8

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

• Denial of service
• CWE-20

<1.13.0 · fixed in 1.13.0

SvelteKit: Big remote form function payloads can cause Node process to crash

• Denial of service
• CWE-248

<2.69.1 · fixed in 2.69.1

find-my-way: DDoS with HTTP2

• Prototype pollution
• CWE-20

<9.7.0 · fixed in 9.7.0

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

• CWE-20
• CWE-248

>=0.1.0, <0.41.3 · fixed in 0.41.3

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

• Denial of service
• Broken access control

<1.82.1 · fixed in 1.82.1

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

• CWE-248

<2.9.0 · fixed in 2.9.0

websocket-driver-ruby: Denial of service via malformed Host header

• CWE-248

<0.8.2 · fixed in 0.8.2

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

• CWE-20
• CWE-248

<5.2.6 · fixed in 5.2.6

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

• CWE-248

<7.5.17 · fixed in 7.5.17

Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-248

Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB

• CWE-248

* · no fixed version yet

Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

• CWE-248

* · no fixed version yet

Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist

• CWE-248

<=1.1.1 · no fixed version yet

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

• CWE-248
• CWE-755

<4.40.1 · fixed in 4.40.1

nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

• CWE-248

<1.6.0 · fixed in 1.6.0

NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can…

• NVIDIA Triton Inference Server
• CWE-248

Windows Server Update Service (WSUS) Tampering Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-20
• CWE-248

NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size

• M2Team NanaZip
• Denial of service
• CWE-248

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

• nats-io nats-server
• CWE-248

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

• Denial of service
• CWE-248

<0.1.11 · fixed in 0.1.11

Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific re…

• Gallagher Controller 7000 and 6000
• CWE-248

Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service.

• Gallagher T-20 Readers
• CWE-248

Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

• CWE-248

<4.5.0 · fixed in 4.5.0

Zebra: Finalized address balance credit-first overflow on consensus-valid blocks

• CWE-248

<4.5.0 · fixed in 4.5.0

zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

• Denial of service
• CWE-20

<4.5.0 · fixed in 4.5.0

zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

• CWE-248

<4.5.0 · fixed in 4.5.0

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

• CWE-248
• CWE-754

<3.1.0 · fixed in 3.1.0

@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

• @fastify/middie
• CWE-248

Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER

• mastodon
• CWE-248

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

• CWE-248
• CWE-754

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

ts-deepmerge: Prototype Method Override leads to DoS

• CWE-248

<8.0.0 · fixed in 8.0.0

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

• CWE-248

<2.7.5 · fixed in 2.7.5

@grpc/grpc-js: A malformed request can cause a server crash

• CWE-248

<1.9.16 || >=1.10.0, <1.10.12 || >=1.11.0, <1.11.4 || >=1.12.0, <1.12.7 || >=1.13.0, <1.13.5 || >=1.14.0, <1.14.4 · fixed in 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4

@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash

• Denial of service
• CWE-248

<1.9.16 || >=1.10.0, <1.10.12 || >=1.11.0, <1.11.4 || >=1.12.0, <1.12.7 || >=1.13.0, <1.13.5 || >=1.14.0, <1.14.4 · fixed in 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, 1.14.4

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

• Denial of service
• CWE-248

<17.13.4 || >=18.0.0, <18.2.1 · fixed in 17.13.4, 18.2.1

FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older

• halfgaar FlashMQ
• CWE-248

Uncaught exception vulnerability in Suprema's BioStar

• Suprema BioStar 2 (server)
• CWE-248

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

• PMQS IO::Uncompress::Unzip
• CWE-248

Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification

• riebl vanetza
• CWE-248

Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing

• riebl vanetza
• CWE-248

nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item

• CWE-248

<1.5.0 · fixed in 1.5.0

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

• Denial of service
• CWE-248

<3.12.0 · fixed in 3.12.0

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

• CWE-20
• CWE-248

<0.9.0 · fixed in 0.9.0

OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

• CWE-20
• CWE-248

<0.9.0 · fixed in 0.9.0

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

• Prototype pollution
• CWE-248

<4.3.0 · fixed in 4.3.0

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

• ModSecurity
• Memory corruption
• CWE-248

vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

• CWE-248

<3.11.0 · fixed in 3.11.0

scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

• Denial of service
• CWE-248

<1.9.3 · fixed in 1.9.3

Granian vulnerable to DoS via WSGI response header panic

• CWE-248
• CWE-755

>=0.2.0, <2.7.4 · fixed in 2.7.4