Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Calls to squashfs.Read on potentially untrusted squashfs images without panic recovery can cause a denial of service if malformed image headers trigger runtime panics in go-diskfs.
Dynamic regular expression compilation with 'qr/$var/' without an enclosing 'eval' block can throw a fatal exception if the variable contains invalid regex syntax, causing a denial of service.
A zlib stream was initialized and listened to without attaching an 'error' event handler. In Node.js, unhandled 'error' events on streams throw uncaught exceptions, leading to process crashes when processing invalid or malformed compressed input.
Stream handler performs early returns during validation before registering an 'error' event listener on the stream object. Unhandled stream errors can cause uncaught exceptions and crash the server process.
`SimpleCookie.load()` or `BaseCookie.load()` can raise a `CookieError` on malformed inputs. If this method is called on user-supplied data without a `try...except` block, it can cause an unhandled exception, leading to a Denial of Service (DoS). Wrap the `load()` call in a `try...except` block to handle exceptions safely.
Asynchronous message extraction or decryption function is invoked without a try-catch block. Exceptions thrown during message parsing or decryption (e.g., malformed payloads or MAC validation failures) cause unhandled promise rejections, leading to process crashes and Denial of Service (DoS).
Exception is incorrectly initialized with a string containing format specifiers, but arguments are passed via comma instead of the modulo operator (`%`), `.format()`, or f-strings. This will put a tuple as the exception argument rather than correctly formatting the string, leading to improper error message propagation, or uncaught exceptions (like TypeError
Accessing a query parameter without verifying its existence could cause an unhandled exception or promise rejection if the receiving function does not gracefully handle `undefined`. Explicitly validate the presence of user-controlled parameters before passing them to internal APIs to prevent application crashes.
The application passes user-controlled data to a Node.js asynchronous filesystem API (like `fs.stat`) without wrapping the call in a `try/catch` block. In Node.js, passing invalid characters such as null bytes (`%00`) to `fs` functions can cause a synchronous exception to be thrown before the async callback is invoked. Without a `try/catch`, this unhandled e
Calling `.expect()` or `.unwrap()` on the result of a parser combinator method like `parse_next()` or `parse_peek()` can cause a panic on untrusted input, leading to a Denial of Service. Parser combinators such as `winnow` may return errors on malformed inputs (e.g., to break out of zero-byte consumption infinite loops). Propagate errors gracefully using the
