CWEweakness

CWE-248 Uncaught Exception

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
C#, C++, Java
CWE version
5.0

Description

An exception is thrown from a function, but it is not caught.

Common consequences

• Availability, Confidentiality: DoS: Crash, Exit, or Restart, Read Application Data — An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.

Potential mitigations

• [Requirements] The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem. • [Requirements] A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added. • [Implementation] Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2023-41151: SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error • CVE-2023-21087: Java code in a smartphone OS can encounter a "boot loop" due to an uncaught exception

Related

Observed example · CVE (2)

  • CVE-2023-41151 An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to… vulnerability
  • CVE-2023-21087 In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. vulnerability

Child of · CWE (3)

  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness
  • CWE-705 Incorrect Control Flow Scoping weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

Referenced by CVE · weakness (362)

  • CVE-2026-119052 llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote… vulnerability
  • CVE-2026-111107 A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with… vulnerability
  • CVE-2026-117541 svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting… vulnerability
  • CVE-2026-116589 Datadog dd-trace-py is the Datadog Python APM client. vulnerability
  • CVE-2026-115892 Wasmtime is a runtime for WebAssembly. vulnerability
  • CVE-2026-89312 `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. vulnerability
  • CVE-2026-89315 `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped… vulnerability
  • CVE-2026-89316 `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. vulnerability
  • CVE-2026-89318 `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. vulnerability
  • CVE-2026-111181 body-parser is body parsing middleware for Node.js and Express. vulnerability
  • CVE-2026-113872 multer is a middleware for Node.js that handles multipart/form-data file uploads. vulnerability
  • CVE-2026-114051 vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore… vulnerability
  • CVE-2026-114102 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a… vulnerability
  • CVE-2026-76493 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has… vulnerability
  • CVE-2026-82231 A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it… vulnerability
  • CVE-2026-105661 Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a… vulnerability
  • CVE-2026-42270 countly-server is the server-side part of Countly, a product analytics solution. vulnerability
  • CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. vulnerability
  • CVE-2026-103936 libp2p is a JavaScript implementation of the libp2p networking stack. vulnerability
  • CVE-2026-109855 undici is an HTTP client library for Node.js. vulnerability
  • CVE-2026-109869 undici is an HTTP client library for Node.js. vulnerability
  • CVE-2026-110933 Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. vulnerability
  • CVE-2026-79833 A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate… vulnerability
  • CVE-2026-87018 undici is an HTTP client library for Node.js. vulnerability
  • CVE-2026-87029 undici is an HTTP client library for Node.js. vulnerability
  • CVE-2026-97394 kin-openapi is a Go project for handling OpenAPI files. vulnerability
  • CVE-2026-110816 ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element… vulnerability
  • CVE-2026-110854 Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset… vulnerability
  • CVE-2026-67416 RabbitMQ is a messaging and streaming broker. vulnerability
  • CVE-2026-67418 RabbitMQ is a messaging and streaming broker. vulnerability
Show all 362 ›

Referenced by CWE · child of (1)

  • CWE-600 Uncaught Exception in Servlet weakness

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (1)

  • A10:2025 Mishandling of Exceptional Conditions Top 10 2025