If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

Primary

Resultant

Implementation

High

Integrity
Confidentiality
Availability
Access Control
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
There is the potential for arbitrary code execution with privileges of the vulnerable program if function parameter list is exhausted.

Availability
DoS: Crash, Exit, or Restart
Potentially a program could fail if it needs more arguments then are available.

Build and Compilation
This issue can be simply combated with the use of proper build process.

Implementation
Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.

The following example demonstrates the weakness.

foo_funct(one, two);
void foo_funct(int one, int two, int three) {printf("1) %d\n2) %d\n3) %d\n", one, two, three);}

void some_function(int foo, ...) {int a[3], i;va_list ap;va_start(ap, foo);for (i = 0; i < sizeof(a) / sizeof(int); i++) a[i] = va_arg(ap, int);va_end(ap);}
int main(int argc, char *argv[]) {some_function(17, 42);}

This can be exploited to disclose information with no work whatsoever. In fact, each time this function is run, it will print out the next 4 bytes on the stack after the two numbers sent to it.

CVE-2004-0276
Server earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field.
https://www.cve.org/CVERecord?id=CVE-2004-0276

CVE-2002-1488
Chat client allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with (1) a missing channel or (2) a channel that the user is not in.
https://www.cve.org/CVERecord?id=CVE-2002-1488

CVE-2002-1169
Proxy allows remote attackers to cause a denial of service (crash) via an HTTP request to helpout.exe with a missing HTTP version numbers.
https://www.cve.org/CVERecord?id=CVE-2002-1169

CVE-2000-0521
Web server allows disclosure of CGI source code via an HTTP request without the version number.
https://www.cve.org/CVERecord?id=CVE-2000-0521

CVE-2001-0590
Application server allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification.
https://www.cve.org/CVERecord?id=CVE-2001-0590

CVE-2003-0239
Chat software allows remote attackers to cause a denial of service via malformed GIF89a headers that do not contain a GCT (Global Color Table) or an LCT (Local Color Table) after an Image Descriptor.
https://www.cve.org/CVERecord?id=CVE-2003-0239

CVE-2002-1023
Server allows remote attackers to cause a denial of service (crash) via an HTTP GET request without a URI.
https://www.cve.org/CVERecord?id=CVE-2002-1023

CVE-2002-1236
CGI crashes when called without any arguments.
https://www.cve.org/CVERecord?id=CVE-2002-1236

CVE-2003-0422
CGI crashes when called without any arguments.
https://www.cve.org/CVERecord?id=CVE-2003-0422

CVE-2002-1531
Crash in HTTP request without a Content-Length field.
https://www.cve.org/CVERecord?id=CVE-2002-1531

CVE-2002-1077
Crash in HTTP request without a Content-Length field.
https://www.cve.org/CVERecord?id=CVE-2002-1077

CVE-2002-1358
Empty elements/strings in protocol test suite affect many SSH2 servers/clients.
https://www.cve.org/CVERecord?id=CVE-2002-1358

CVE-2003-0477
FTP server crashes in PORT command without an argument.
https://www.cve.org/CVERecord?id=CVE-2003-0477

CVE-2002-0107
Resultant infoleak in web server via GET requests without HTTP/1.0 version string.
https://www.cve.org/CVERecord?id=CVE-2002-0107

CVE-2002-0596
GET request with empty parameter leads to error message infoleak (path disclosure).
https://www.cve.org/CVERecord?id=CVE-2002-0596

Missing Parameter Error

Missing parameter

Discouraged
This CWE entry could be deprecated in a future version of CWE.
See maintenance notes.

This entry will be deprecated in a future version of CWE. The term "missing parameter" was used in both PLOVER and CLASP, with completely different meanings. However, data from both taxonomies was merged into this entry. In PLOVER, it was meant to cover malformed inputs that do not contain required parameters, such as a missing parameter in a CGI request. This entry's observed examples and classification came from PLOVER. However, the description, demonstrative example, and other information are derived from CLASP. They are related to an incorrect number of function arguments, which is already covered by CWE-685.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-24
updated Observed_Examples

CWE Content Team
MITRE
2009-03-09
Critical
added maintenance note: this entry will probably be deprecated

CWE Content Team
MITRE
2009-03-10
updated Maintenance_Notes, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2013-07-17
updated Type

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Demonstrative_Examples

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships, Weakness_Ordinalities

Missing Parameter Error