CWEweakness

CWE-440 Expected Behavior Violation

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

A feature, API, or function does not perform according to its specification.

Common consequences

• Other: Quality Degradation, Varies by Context

Observed examples

• CVE-2003-0187: Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations. • CVE-2003-0465: "strncpy" in Linux kernel acts different than libc on x86, leading to expected behavior difference - sort of a multiple interpretation error? • CVE-2005-3265: Buffer overflow in product stems the use of a third party library function that is expected to have internal protection against overflows, but doesn't.

Related

Observed example · CVE (3)

  • CVE-2005-3265 Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2)… vulnerability
  • CVE-2003-0187 The connection tracking core of Netfilter for Linux 2.4.20, with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded, allows… vulnerability
  • CVE-2003-0465 The kernel strncpy function in Linux 2.4 and 2.5 does not %NUL pad the buffer on architectures other than x86, as opposed to the expected… vulnerability

Child of · CWE (1)

  • CWE-684 Incorrect Provision of Specified Functionality weakness

Referenced by CVE · weakness (48)

  • CVE-2026-114049 vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients'… vulnerability
  • CVE-2026-93675 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. vulnerability
  • CVE-2026-35191 Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple… vulnerability
  • CVE-2026-97687 urllib3 is an HTTP client library for Python. vulnerability
  • CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. vulnerability
  • CVE-2026-65932 The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. vulnerability
  • CVE-2026-65934 An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. vulnerability
  • CVE-2026-8806 Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions… vulnerability
  • CVE-2026-42752 Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions. vulnerability
  • CVE-2026-49316 Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an… vulnerability
  • CVE-2026-42534 NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade… vulnerability
  • CVE-2026-41136 free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core… vulnerability
  • CVE-2026-35040 fast-jwt provides fast JSON Web Token (JWT) implementation. vulnerability
  • CVE-2026-3344 A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited… vulnerability
  • CVE-2025-13940 An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time… vulnerability
  • CVE-2025-8850 In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. vulnerability
  • CVE-2025-52953 An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows… vulnerability
  • CVE-2025-6211 A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing… vulnerability
  • CVE-2025-3044 A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash… vulnerability
  • CVE-2025-40555 A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). vulnerability
  • CVE-2025-46712 Erlang/OTP is a set of libraries for the Erlang programming language. vulnerability
  • CVE-2023-26819 cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [… vulnerability
  • CVE-2025-32728 In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent… vulnerability
  • CVE-2024-56202 Expected Behavior Violation vulnerability in Apache Traffic Server. vulnerability
  • CVE-2025-27401 Tuleap is an Open Source Suite to improve management of software developments and collaboration. vulnerability
  • CVE-2025-27094 Tuleap is an open-source suite designed to improve software development management and collaboration. vulnerability
  • CVE-2024-47762 Backstage is an open framework for building developer portals. vulnerability
  • CVE-2024-8690 A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows… vulnerability
  • CVE-2024-7246 It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that… vulnerability
  • CVE-2024-38806 Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0… vulnerability
Show all 48 ›

Referenced by CWE · child of (1)

  • CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters weakness