CWEweakness
CWE-670 Always-Incorrect Control Flow Implementation
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Extended description
This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.
Common consequences
• Other: Other, Alter Execution Logic
Observed examples
• CVE-2021-3011: virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
Related
Observed example · CVE (1)
- CVE-2021-3011 An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication… vulnerability
Child of · CWE (1)
- CWE-691 Insufficient Control Flow Management weakness
Referenced by CVE · weakness (162)
- CVE-2026-117859 A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. vulnerability
- CVE-2020-37288 Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or… vulnerability
- CVE-2026-109722 JIT miscompilation in the JavaScript Engine: JIT component. vulnerability
- CVE-2026-79608 The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. vulnerability
- CVE-2026-107284 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. vulnerability
- CVE-2026-106586 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a… vulnerability
- CVE-2026-102110 An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state… vulnerability
- CVE-2026-102124 A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. vulnerability
- CVE-2026-98164 In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces… vulnerability
- CVE-2026-96760 Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. vulnerability
- CVE-2026-98051 In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times The… vulnerability
- CVE-2026-92932 In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional… vulnerability
- CVE-2026-73468 A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in… vulnerability
- CVE-2026-55624 MintyItanium Lost-Auction is an auction plugin for Minecraft. vulnerability
- CVE-2026-72703 The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different… vulnerability
- CVE-2026-72704 The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that parameter has… vulnerability
- CVE-2026-72705 The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. vulnerability
- CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick… vulnerability
- CVE-2026-20713 Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. vulnerability
- CVE-2026-73283 In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. vulnerability
- CVE-2026-16392 JIT miscompilation in the JavaScript Engine: JIT component. vulnerability
- CVE-2026-14935 A logic vulnerability was found in GStreamer's webrtcbin component. vulnerability
- CVE-2026-56328 Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates… vulnerability
- CVE-2026-53404 Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR… vulnerability
- CVE-2026-55276 Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints… vulnerability
- CVE-2026-7656 The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect… vulnerability
- CVE-2026-56307 Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path… vulnerability
- CVE-2026-12321 JIT miscompilation in the JavaScript: WebAssembly component. vulnerability
- CVE-2026-48844 Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could… vulnerability
- CVE-2026-20171 A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus… vulnerability
Referenced by CWE · child of (6)
Referenced by CWE · has member (1)
- CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities view