CWE-248: Uncaught Exception

An exception is thrown from a function, but it is not caught.

When an exception is not caught, it may cause the program to crash or expose sensitive information.

Consequences

• Availability, Confidentiality: DoS: Crash, Exit, or Restart, Read Application Data

Recent advisories

• GHSA-8hrf-8g6f-7xwp — Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
• GHSA-27r3-jxmh-p828 — body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
• GHSA-9pvw-hwfg-92h5 — Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
• GHSA-55wc-3pg8-jfw6 — undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
• GHSA-qrxm-fqhp-jwvm — undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
• GHSA-xjj6-f33q-929c — undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
• GHSA-qq8j-7v2v-3rwp — undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
• GHSA-6pq8-jhm2-2vcw — qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
• GHSA-85xf-c7hm-whqw — vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
• GHSA-2823-qmq8-rwvj — vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
• GHSA-x5rw-q4pp-hg5g — devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
• GHSA-42vr-xj54-vc7v — PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
• GHSA-2v2p-6j97-cjg9 — vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
• PYSEC-2026-4004 — vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments.
• GHSA-gjq8-xm47-88rc — vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

All advisories for CWE-248