CWEweakness
CWE-230 Improper Handling of Missing Values
- Abstraction
- Variant
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
Common consequences
• Integrity: Unexpected State
Detection methods
• Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
Observed examples
• CVE-2002-0422: Blank Host header triggers resultant infoleak.
• CVE-2000-1006: Blank "charset" attribute in MIME header triggers crash.
• CVE-2004-1504: Blank parameter causes external error infoleak.
• CVE-2005-2053: Blank parameter causes external error infoleak.
Related
Observed example · CVE (4)
- CVE-2005-2053 Just another flat file (JAF) CMS before 3.0 Final allows remote attackers to obtain sensitive information via (1) an * (asterisk) in the id… vulnerability
- CVE-2004-1504 The displaycontent function in config.php for Just Another Flat file (JAF) CMS 3.0RC allows remote attackers to gain sensitive information… vulnerability
- CVE-2002-0422 IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured… vulnerability
- CVE-2000-1006 Microsoft Exchange Server 5.5 does not properly handle a MIME header with a blank charset specified, which allows remote attackers to cause… vulnerability
Child of · CWE (1)
- CWE-229 Improper Handling of Values weakness
Referenced by CVE · weakness (13)
- CVE-2026-19395 In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty… vulnerability
- CVE-2026-25658 Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an… vulnerability
- CVE-2026-25659 Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an… vulnerability
- CVE-2026-20086 A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless… vulnerability
- CVE-2026-1461 The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0… vulnerability
- CVE-2025-23225 IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user to cause a denial of service due to the improper handling of… vulnerability
- CVE-2024-11024 The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up… vulnerability
- CVE-2024-10508 The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation… vulnerability
- CVE-2024-9781 AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted… vulnerability
- CVE-2024-6237 A flaw was found in the 389 Directory Server. vulnerability
- CVE-2024-0048 In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of… vulnerability
- CVE-2024-0208 GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted… vulnerability
- CVE-2023-1697 An Improper Handling of Missing Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent,… vulnerability