CWE-248.

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

• CWE-248
• CWE-703

>=3.10.0, <3.11.8 · fixed in 3.11.8

In multiple places, there is a possible denial of service due to an uncaught exception.

• Google Android
• CWE-248

Apache Thrift: Perl servers end `serve()` when serving one connection fails

• Apache Software Foundation Apache Thrift
• CWE-248

Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

• Apache Software Foundation Apache Thrift
• CWE-248
• CWE-755

Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)

• Apache Software Foundation Apache Thrift
• Prototype pollution
• CWE-248

Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-248

Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

• Apache Software Foundation Apache Thrift
• Memory corruption
• Denial of service

Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

• Apache Software Foundation Apache Thrift
• CWE-248
• CWE-755

Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception

• Apache Software Foundation Apache Thrift
• CWE-248

Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-248

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-130

Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-248

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

• CWE-248
• CWE-755

>=5.8.0, <5.9.3 · fixed in 5.9.3

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

• CWE-248

<5.12.5 · fixed in 5.12.5

Astro: Malformed port in the Host header can crash the Node adapter

• CWE-248

<11.1.3 · fixed in 11.1.3

garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

• garycourt uri-js
• CWE-248

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

• CWE-248

>=2.0.0a1, <2.15.0 · fixed in 2.15.0

Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

• Apache Software Foundation Apache PLC4X
• Denial of service
• CWE-129

Nest: Remote process termination via a deeply nested microservice message pattern

• Denial of service
• CWE-248

<11.2.4 || >=12.0.0, <12.0.2 · fixed in 11.2.4, 12.0.2

Socket.IO: Engine.IO Protocol Revision Mismatch DoS

• CWE-248

>=6.6.0, <6.6.10 · fixed in 6.6.10

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

• Denial of service
• CWE-248

<0.6.1 · fixed in 0.6.1

Uncaught exception in Baicells Nova 430H

• Baicells Nova 430H eNodeB (model pBS3101SH)
• CWE-248

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

• CWE-248
• CWE-252

>=6.7.0, <6.28.1 || >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 6.28.1, 7.29.1, 8.10.2

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

• CWE-20
• CWE-248

>=7.1.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 7.29.1, 8.10.2

undici vulnerable to Denial of Service via WebSocketStream unclean close

• CWE-248
• CWE-754

>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 7.29.1, 8.10.2

undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

• CWE-248

>=6.25.0, <6.28.1 || >=7.28.0, <7.29.1 || >=8.1.0, <8.10.2 · fixed in 6.28.1, 7.29.1, 8.10.2

ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception

• ag-ui
• CWE-248

aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception

• aligungr UERANSIM
• CWE-248

Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

• CWE-248

<3.12.2 · fixed in 3.12.2

stoatchat before 0.15.5 Denial of Service via mass mentions

• stoatchat
• CWE-248

Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

• Apache Software Foundation Apache Qpid Broker-J
• CWE-248

Denial of Service Vulnerability

• Zohocorp ManageEngine EventLog Analyzer
• Zohocorp ManageEngine Log360
• CWE-248

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

• Denial of service
• Broken access control

<0.18.1 · fixed in 0.18.1

request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

• CWE-248

<3.2.1 · fixed in 3.2.1

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incom...

• CWE-248

<0.30.0 · fixed in 0.30.0

Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.

• CWE-248

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

• parseable
• CWE-248
• CWE-703

Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

• CWE-248

>=3.10.0, <=3.11.7 · no fixed version yet

Pocketbase: Unhandled panic in worker goroutines

• CWE-248

<0.22.48 || >=0.23.0, <0.39.7 · fixed in 0.22.48, 0.39.7

Panic via negative shared-string index in github.com/xuri/excelize

• CWE-248
• CWE-755

<2.11.0 · fixed in 2.11.0

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

• CWE-248

<0.13.1 · fixed in 0.13.1

Server panic via missing authority or Host headers in google.golang.org/grpc

• CWE-129
• CWE-248

<1.82.2 || >=1.83.0, <1.83.2 || >=1.84.0-dev, <1.84.0-dev.0.20260825144003-d5a41119e0e3 || >=1.85.0-dev, <1.85.0-dev.0.20260825072537-93e31b48545e · fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e

Uncontrolled resource consumption in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Denial of service
• CWE-248

hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

• hbs
• CWE-248

rclone local: crafted Range request against a translated symlink panics (DoS)

• Memory corruption
• CWE-248

<1.75.1 · fixed in 1.75.1

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

• Information disclosure
• Broken access control

<0.27.1 · fixed in 0.27.1

multer vulnerable to Denial of Service via crafted multipart field names

• CWE-248

<2.3.0 · fixed in 2.3.0

Windows iSCSI Target Service Denial of Service Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-248

Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service

• MongoDB Server
• CWE-248

qs: Denial of Service via Attacker Controlled isBuffer

• CWE-248
• CWE-703

>=2.2.5, <6.16.0 · fixed in 6.16.0

Uncaught Exception in Kibana Leading to Denial of Service

• Elastic Kibana
• CWE-248

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

• Prototype pollution
• CWE-248

<4.28.7 · fixed in 4.28.7

MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

• MongoDB BI Connector
• CWE-248

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

• CWE-248
• CWE-754

<0.0.0-20260617230736-314b6783e196 · fixed in 0.0.0-20260617230736-314b6783e196

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

• Information disclosure
• Broken access control

<0.16.1 · fixed in 0.16.1

Faktory: Unrecovered panic in command handlers allows full-server denial of service

• contribsys faktory
• CWE-248

postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

• CWE-20
• CWE-248

<0.6.12 · fixed in 0.6.12

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

• CWE-248

netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

• Memory corruption
• CWE-248

<0.0.23.Final · fixed in 0.0.23.Final

asteval has a Sandbox Escape via BaseException Subclasses

• CWE-248

<1.0.9 · fixed in 1.0.9