CWEweakness

CWE-228 Improper Handling of Syntactically Invalid Structure

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

Common consequences

• Integrity, Availability: Unexpected State, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU) — If an input is syntactically invalid, then processing the input could place the system in an unexpected state that could lead to a crash, consume available system resources or other unintended behaviors.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2004-0270: Anti-virus product has an assertion error when the line length is non-numeric.

Related

Observed example · CVE (1)

  • CVE-2004-0270 libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an… vulnerability

Child of · CWE (2)

  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness
  • CWE-707 Improper Neutralization weakness

Referenced by CVE · weakness (22)

  • CVE-2026-107299 msgpack5 is a msgpack v5 implementation for node.js and the browser. vulnerability
  • CVE-2026-87986 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs… vulnerability
  • CVE-2026-50103 A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing… vulnerability
  • CVE-2025-59174 Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially… vulnerability
  • CVE-2026-25657 Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structure (CWE-228)… vulnerability
  • CVE-2026-42100 Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by… vulnerability
  • CVE-2026-34232 Firebird is an open-source relational database management system. vulnerability
  • CVE-2024-53828 Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially… vulnerability
  • CVE-2026-20125 A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote… vulnerability
  • CVE-2025-2529 Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache… vulnerability
  • CVE-2025-47736 dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8. vulnerability
  • CVE-2024-55594 An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10… vulnerability
  • CVE-2023-42784 An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10… vulnerability
  • CVE-2025-0343 Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. vulnerability
  • CVE-2024-6382 Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. vulnerability
  • CVE-2024-22809 Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder… vulnerability
  • CVE-2024-22815 An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of… vulnerability
  • CVE-2024-21612 An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos… vulnerability
  • CVE-2021-38443 Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in… vulnerability
  • CVE-2021-36199 Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop. vulnerability
  • CVE-2020-27847 A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. vulnerability
  • CVE-2018-5381 The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the… vulnerability

Referenced by CWE · child of (7)

  • CWE-166 Improper Handling of Missing Special Element weakness
  • CWE-167 Improper Handling of Additional Special Element weakness
  • CWE-168 Improper Handling of Inconsistent Special Elements weakness
  • CWE-229 Improper Handling of Values weakness
  • CWE-233 Improper Handling of Parameters weakness
  • CWE-237 Improper Handling of Structural Elements weakness
  • CWE-241 Improper Handling of Unexpected Data Type weakness

Referenced by CWE · has member (1)