The product does not handle or incorrectly handles an exceptional condition.

Primary

Resultant

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Medium

Other
Other

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

The following example attempts to resolve a hostname.

protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {String ip = req.getRemoteAddr();InetAddress addr = InetAddress.getByName(ip);...out.println("hello " + addr.getHostName());}

A DNS lookup failure will cause the Servlet to throw an exception.

The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.

foo=malloc(sizeof(char)); //the next line checks to see if malloc failedif (foo==NULL) {//We do nothing so we just ignore the error.}

The conditional successfully detects a NULL return value from malloc indicating a failure, however it does not do anything to handle the problem. Unhandled errors may have unexpected results and may cause the program to crash or terminate.
Instead, the if block should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following example notifies the user that the malloc function did not allocate the required memory resources and returns an error code.

foo=malloc(sizeof(char)); //the next line checks to see if malloc failedif (foo==NULL) {printf("Malloc failed to allocate memory resources");return -1;}

The following code mistakenly catches a NullPointerException.

try {

mysteryMethod();

} catch (NullPointerException npe) {
}

CVE-2023-41151
SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
https://www.cve.org/CVERecord?id=CVE-2023-41151

[REF-1374]
Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards

CVE-2021-3011
virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
https://www.cve.org/CVERecord?id=CVE-2021-3011

CVE-2008-4302
Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.
https://www.cve.org/CVERecord?id=CVE-2008-4302

Discouraged
This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2009-03-03
1.3
2009-03-10
New entry for reorganization of CWE-703.

CWE Content Team
MITRE
2009-12-28
updated Applicable_Platforms, Likelihood_of_Exploit, Time_of_Introduction

CWE Content Team
MITRE
2010-12-13
updated Description, Observed_Examples

CWE Content Team
MITRE
2011-03-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Likelihood_of_Exploit, Modes_of_Introduction, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Observed_Examples

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples, Mapping_Notes, Observed_Examples, References, Relationships

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors, Relationships, Weakness_Ordinalities