CWE-755 Improper Handling of Exceptional Conditions

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Valibot: record() issue paths can make flatten() throw for inherited Object property names

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

Routinator crashes when encountering maliciously crafted RRDP XML files

@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

Prometheus exporter process crash via malformed HTTP request

Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check