When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.
On most systems, a combination of setting the SO_REUSEADDR socket option, and a call to bind() allows any process to bind to a port to which a previous process has bound with INADDR_ANY. This allows a user to bind to the specific address of a server bound to INADDR_ANY on an unprivileged port, and steal its UDP packets/TCP connection.

Primary

Implementation

Operation

Confidentiality
Integrity
Read Application Data
Packets from a variety of network services may be stolen or the services spoofed.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Policy
Restrict server socket address to known local addresses.

This code binds a server socket to port 21, allowing the server to listen for traffic on that port.

void bind_socket(void) {

int server_sockfd;int server_len;struct sockaddr_in server_address;

/*unlink the socket if already bound to avoid an error when bind() is called*/

unlink("server_socket");server_sockfd = socket(AF_INET, SOCK_STREAM, 0);
server_address.sin_family = AF_INET;server_address.sin_port = 21;server_address.sin_addr.s_addr = htonl(INADDR_ANY);server_len = sizeof(struct sockaddr_in);
bind(server_sockfd, (struct sockaddr *) &s1, server_len);
}

This code may result in two servers binding a socket to same port, thus receiving each other's traffic. This could be used by an attacker to steal packets meant for another process, such as a secure FTP server.

SFP32
Multiple binds to the same port

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Anonymous Tool Vendor (under NDA)
2007-05-07
Draft 6
2007-05-07

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2009-10-29
updated Common_Consequences

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Demonstrative_Examples

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Enabling_Factors_for_Exploitation, Other_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Description, Enabling_Factors_for_Exploitation, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Weakness_Ordinalities

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Type

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors

Multiple Binds to Same Port