CWE-248 vulnerabilities

RaTeX versions prior to 0.1.11 contain a vulnerability where the parser panics and aborts the process when handling a specific malformed input involving a multibyte UTF-8 delimiter in the \verb command. This results in a denial of service by crashing the entire process rendering untrusted LaTeX. The issue is fixed in version 0.1.11.

CVE-2026-52731 is a vulnerability in ZcashFoundation's Zebra node software prior to version 4.5.0. An authenticated attacker can send a specially crafted getblocktemplate LongPollId containing multi-byte UTF-8 characters to an enabled Zebra RPC endpoint, causing the node process to abort due to a panic triggered by invalid string slicing. This results in a denial of service by terminating the zebrad process. The issue is fixed in Zebra versions 4.5.0 and later.

CVE-2026-52738 is a vulnerability in ZcashFoundation's Zebra node software prior to version 4.5.0. It involves an uncaught exception caused by processing a consensus-valid block with a long chain of transparent self-spends to one address. The issue arises because the finalized-state writer credits outputs before debiting spent outputs, causing intermediate balances to exceed the maximum allowed value and triggering a panic that halts the node. This halt persists on every restart until the software is updated. The vulnerability is fixed in Zebra version 4.5.0.

Zebra, a Zcash node implementation in Rust, has a vulnerability prior to version 4.5.0 where a malicious block producer can cause the node process to terminate unexpectedly. This occurs when the same shielded transaction is included in both a non-finalized parent block and its child, triggering an assertion failure that aborts the process. The issue is fixed in Zebra version 4.5.0.

A vulnerability in websocket-driver-ruby prior to version 0.8.2 allows a remote client to crash a TCP-backed WebSocket server by sending a malformed Host header. The issue arises because the server() method passes this malformed header to URI.parse without catching URI::InvalidURIError exceptions. This uncaught exception leads to a server crash. The vulnerability is fixed in version 0.8.2.

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.

find-my-way versions prior to 9.0.7 contain an improper input validation vulnerability that allows a remote denial of service (DoS) when used with Node's HTTP/2 server. The issue arises because HTTP/2 method values like constructor, toString, or __proto__ can access inherited object properties in the router's internal trees object, causing the application to crash.

A vulnerability in libcupsfilters and cups-filters allows an unauthenticated attacker to cause a denial of service by submitting a specially crafted PNG print job. The flaw arises because the PNG image reading function creates a libpng reader without an error recovery handler, causing the CUPS image filter process to abort on malformed PNG files. This results in the termination of the in-flight print job. The issue has a CVSS score of 7.5 (medium severity).

SurrealDB versions before 1.1.1 contain a vulnerability where improper validation of custom parameters and functions at root or namespace levels can cause the server to panic. Authorized clients can exploit this flaw to crash the server, leading to a denial of service condition.

SurrealDB versions before 1.1.0 contain a vulnerability where the server fails to properly parse certain HTTP REST API headers with special characters. This flaw allows unauthenticated attackers to send crafted requests that cause an uncaught exception, crashing the server and resulting in a denial of service.

SurrealDB versions before 1.2.0 have an uncaught exception vulnerability in the query executor. This flaw occurs when authorized clients send queries that call nonexistent built-in functions, causing the server to panic and crash. The vulnerability allows denial of service by crashing the database server.

SurrealDB versions before 1.2.1 have a vulnerability where malformed queries containing errors on line terminator characters cause an uncaught exception in the span rendering code. This triggers a server panic and crash, resulting in denial of service. The issue affects authorized clients who can submit such malformed queries.

SurrealDB versions before 2.0.4 have a vulnerability where an uncaught exception occurs in the parser error rendering code when processing empty strings. Authorized clients can send malformed queries involving empty string conversions to record, duration, or datetime types, causing a server panic and crash.

SurrealDB versions before 2.1.0 have a denial of service vulnerability triggered by the ORDER BY rand() clause in queries. Authorized clients can cause the server to panic and crash by executing queries that use this sorting mechanism.