CWEweakness

CWE-240 Improper Handling of Inconsistent Structural Elements

Official page ↗
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.

Common consequences

• Integrity, Other: Varies by Context, Unexpected State — If multiple structural elements are inconsistent, then using these elements could place the system into an unexpected state that could lead to a crash, consume available resources, or other unintended behaviors.

Observed examples

• CVE-2014-0160: Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data. • CVE-2009-2299: Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.

Related

Observed example · CVE (2)

  • CVE-2014-0160 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows… vulnerability
  • CVE-2009-2299 The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a… vulnerability

Child of · CWE (2)

  • CWE-237 Improper Handling of Structural Elements weakness
  • CWE-707 Improper Neutralization weakness

Referenced by CVE · weakness (5)

  • CVE-2025-4321 In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard… vulnerability
  • CVE-2023-39914 NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data… vulnerability
  • CVE-2023-39915 NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. vulnerability
  • CVE-2022-40957 Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only… vulnerability
  • CVE-2021-31890 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions… vulnerability

Referenced by CWE · child of (1)

  • CWE-130 Improper Handling of Length Parameter Inconsistency weakness