Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-248 Base Draft
Uncaught Exception
This vulnerability occurs when a function throws an error or exception, but the calling code does not have a proper handler to catch and manage it.
Definition
What is CWE-248?
This vulnerability occurs when a function throws an error or exception, but the calling code does not have a proper handler to catch and manage it.
Uncaught exceptions break the normal flow of your application. Instead of gracefully handling an unexpected condition—like a failed network request, invalid input, or missing file—the program will typically terminate abruptly. This leads to a poor user experience, interrupted operations, and makes debugging more difficult, as the root cause may be obscured by a generic crash.
Beyond causing crashes, unhandled exceptions can leak sensitive internal details about your application's structure, such as stack traces, file paths, or even partial data. Attackers can use this information to map your system and plan further exploits. To prevent this, developers should implement strategic try-catch blocks around risky operations and define clear fallback behaviors or user-friendly error messages.
Real-world impact
Real-world CVEs caused by CWE-248
-
SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
-
Java code in a smartphone OS can encounter a "boot loop" due to an uncaught exception
How attackers exploit it
Step-by-step attacker path
- 1
The following example attempts to resolve a hostname.
- 2
A DNS lookup failure will cause the Servlet to throw an exception.
- 3
The _alloca() function allocates memory on the stack. If an allocation request is too large for the available stack space, _alloca() throws an exception. If the exception is not caught, the program will crash, potentially enabling a denial of service attack. _alloca() has been deprecated as of Microsoft Visual Studio 2005(R). It has been replaced with the more secure _alloca_s().
- 4
EnterCriticalSection() can raise an exception, potentially causing the program to crash. Under operating systems prior to Windows 2000, the EnterCriticalSection() function can raise an exception in low memory situations. If the exception is not caught, the program will crash, potentially enabling a denial of service attack.
Vulnerable code example
Vulnerable Java
The following example attempts to resolve a hostname.
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {
String ip = req.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
...
out.println("hello " + addr.getHostName());
} Secure code example
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist
How to prevent CWE-248
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Detection signals
How to detect CWE-248
Plexicus auto-detects CWE-248 and opens a fix PR in under 60 seconds.
Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.
Frequently asked questions What is CWE-248?
How serious is CWE-248?
What languages or platforms are affected by CWE-248?
How can I prevent CWE-248?
How does Plexicus detect and fix CWE-248?
Where can I learn more about CWE-248?
Frequently asked questions
What is CWE-248?
This vulnerability occurs when a function throws an error or exception, but the calling code does not have a proper handler to catch and manage it.
How serious is CWE-248?
MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.
What languages or platforms are affected by CWE-248?
MITRE lists the following affected platforms: C++, Java, C#.
How can I prevent CWE-248?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
How does Plexicus detect and fix CWE-248?
Plexicus's SAST engine matches the data-flow signature for CWE-248 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-248?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/248.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Related weaknesses
Weaknesses related to CWE-248
CWE-705 Parent
Incorrect Control Flow Scoping
This vulnerability occurs when a program fails to return execution to the correct point in the code after finishing a specific operation…
CWE-382 Sibling
J2EE Bad Practices: Use of System.exit()
This vulnerability occurs when a J2EE application directly calls System.exit(), which forcibly terminates the entire application server…
CWE-395 Sibling
Use of NullPointerException Catch to Detect NULL Pointer Dereference
Using a try-catch block for NullPointerException as a substitute for proper null checks is an anti-pattern. This approach masks the root…
CWE-396 Sibling
Declaration of Catch for Generic Exception
This weakness occurs when code catches a generic exception type like 'Exception' or 'Throwable', which can hide specific errors and create…
CWE-397 Sibling
Declaration of Throws for Generic Exception
This vulnerability occurs when a method is declared to throw an overly broad exception type, such as a generic 'Exception' or 'Throwable'.…
CWE-455 Sibling
Non-exit on Failed Initialization
This vulnerability occurs when software continues to run as normal after encountering a critical security failure during its startup…
CWE-584 Sibling
Return Inside Finally Block
This vulnerability occurs when a function places a return statement inside a finally block. This dangerous pattern silently discards any…
CWE-698 Sibling
Execution After Redirect (EAR)
Execution After Redirect (EAR) occurs when a web application sends a redirect response to a user's browser but continues to run…
CWE-600 Child
Uncaught Exception in Servlet
This vulnerability occurs when a Java Servlet fails to properly catch and handle exceptions, potentially exposing sensitive system…
Resources
Further reading
- MITRE — official CWE-248 https://cwe.mitre.org/data/definitions/248.html
- Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf
Ready when you are
Don't Let Security
Weigh You Down.
Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.