CWEweakness

CWE-239 Failure to Handle Incomplete Element

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly handle when a particular element is not completely specified.

Common consequences

• Integrity, Other: Varies by Context, Unexpected State

Observed examples

• CVE-2002-1532: HTTP GET without \r\n\r\n CRLF sequences causes product to wait indefinitely and prevents other users from accessing it. • CVE-2003-0195: Partial request is not timed out. • CVE-2005-2526: MFV. CPU exhaustion in printer via partial printing request then early termination of connection. • CVE-2002-1906: CPU consumption by sending incomplete HTTP requests and leaving the connections open.

Related

Observed example · CVE (4)

  • CVE-2005-2526 CUPS in Mac OS X 10.3.9 and 10.4.2 allows remote attackers to cause a denial of service (CPU consumption) by sending a partial IPP request… vulnerability
  • CVE-2003-0195 CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does… vulnerability
  • CVE-2002-1532 The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows remote attackers to cause a denial of service… vulnerability
  • CVE-2002-1906 The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) by sending… vulnerability

Child of · CWE (1)

  • CWE-237 Improper Handling of Structural Elements weakness

Peer of · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

Referenced by CVE · weakness (3)

  • CVE-2025-41724 An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. vulnerability
  • CVE-2024-29155 On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of… vulnerability
  • CVE-2020-10280 The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking… vulnerability