The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Primary

Resultant

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Confidentiality
Availability
Integrity
Read Application Data
DoS: Crash, Exit, or Restart
Unexpected State

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Fault Injection - source code
Fault Injection - binary

Cost effective for partial coverage:

Forced Path Execution

High

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Manual Source Code Review (not inspections)

Cost effective for partial coverage:

Focused Manual Spotcheck - Focused manual analysis of source

High

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer

SOAR Partial

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction

High

Consider the following code segment:

char buf[10], cp_buf[10];fgets(buf, 10, stdin);strcpy(cp_buf, buf);

The programmer expects that when fgets() returns, buf will contain a null-terminated string of length 9 or less. But if an I/O error occurs, fgets() will not null-terminate buf. Furthermore, if the end of the file is reached before any characters are read, fgets() returns without writing anything to buf. In both of these situations, fgets() signals that something unusual has happened by returning NULL, but in this code, the warning will not be noticed. The lack of a null terminator in buf can result in a buffer overflow in the subsequent call to strcpy().

The following method throws three types of exceptions.

public void doExchange() throws IOException, InvocationTargetException, SQLException {...}

While it might seem tidier to write

public void doExchange() throws Exception {...}

doing so hampers the caller's ability to understand and handle the exceptions that occur. Further, if a later revision of doExchange() introduces a new type of exception that should be treated differently than previous exceptions, there is no easy way to enforce this requirement.

[REF-1374]
Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards

CVE-2022-22224
Chain: an operating system does not properly process malformed Open Shortest Path First (OSPF) Type/Length/Value Identifiers (TLV) (CWE-703), which can cause the process to enter an infinite loop (CWE-835)
https://www.cve.org/CVERecord?id=CVE-2022-22224

ERR06-J
Do not throw undeclared checked exceptions

Discouraged
This CWE entry is extremely high-level, a Pillar.
Consider children or descendants of this entry instead.

This is a high-level class that might have some overlap with other classes. It could be argued that even "normal" weaknesses such as buffer overflows involve unusual or exceptional conditions. In that sense, this might be an inherent aspect of most other weaknesses within CWE, similar to API Abuse (CWE-227) and Indicator of Poor Code Quality (CWE-398). However, this entry is currently intended to unify disparate concepts that do not have other places within the Research Concepts view (CWE-1000).

CWE Content Team
MITRE
2008-09-09
1.0
2008-09-09
Note: this date reflects when the entry was first published. Draft versions of this entry were provided to members of the CWE community and modified between Draft 9 and 1.0.

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2009-10-29
updated Other_Notes

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2010-12-13
updated Name, Relationship_Notes

CWE Content Team
MITRE
2011-03-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated References, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2014-07-30
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Relationships, Type

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Relationships

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples, Observed_Examples, References, Relationships

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Detection_Factors, References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Diagram, Relationships, Weakness_Ordinalities

Failure to Handle Exceptional Conditions