CWEweakness

CWE-253 Incorrect Check of Function Return Value

Low Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Likelihood of exploit
Low
Languages
Not Language-Specific
CWE version
5.0

Description

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Common consequences

• Availability, Integrity: Unexpected State, DoS: Crash, Exit, or Restart — An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.

Potential mitigations

• [Architecture and Design] Use a language or compiler that uses exceptions and requires the catching of those exceptions. • [Implementation] Properly check all functions which return a value. • [Implementation] When designing any function make sure you return a value or throw an exception in case of an error.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2023-49286: Chain: function in web caching proxy does not correctly check a return value (CWE-253) leading to a reachable assertion (CWE-617)

Related

Observed example · CVE (1)

  • CVE-2023-49286 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. vulnerability

Child of · CWE (2)

  • CWE-573 Improper Following of Specification by Caller weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

Referenced by CVE · weakness (25)

  • CVE-2026-15686 Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. vulnerability
  • CVE-2026-59847 A flaw was found in libssh. vulnerability
  • CVE-2026-53090 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in subprogs Usage of… vulnerability
  • CVE-2026-5818 Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of… vulnerability
  • CVE-2026-46419 Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor… vulnerability
  • CVE-2026-43863 mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. vulnerability
  • CVE-2026-35339 The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. vulnerability
  • CVE-2026-35340 A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive… vulnerability
  • CVE-2026-35091 A flaw was found in Corosync. vulnerability
  • CVE-2026-0648 The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in… vulnerability
  • CVE-2025-11839 A security flaw has been discovered in GNU Binutils 2.45. vulnerability
  • CVE-2025-57767 Asterisk is an open source private branch exchange and telephony toolkit. vulnerability
  • CVE-2025-54090 A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". vulnerability
  • CVE-2024-43521 Windows Hyper-V Denial of Service Vulnerability vulnerability
  • CVE-2024-32475 Envoy is a cloud-native, open source edge and service proxy. vulnerability
  • CVE-2024-1622 Due to a mistake in error checking, Routinator will terminate when an incoming RTR connection is reset by the peer too quickly after… vulnerability
  • CVE-2023-52040 An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function. vulnerability
  • CVE-2023-49286 Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. vulnerability
  • CVE-2023-4501 User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise… vulnerability
  • CVE-2023-24487 Arbitrary file read in Citrix ADC and Citrix Gateway vulnerability
  • CVE-2023-34449 ink! vulnerability
  • CVE-2022-24880 flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. vulnerability
  • CVE-2021-37625 Skytable is an open source NoSQL database. vulnerability
  • CVE-2020-6107 An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. vulnerability
  • CVE-2017-7474 It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. vulnerability

Referenced by CWE · has member (1)