CWEweakness
CWE-705 Incorrect Control Flow Scoping
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
Common consequences
• Other: Alter Execution Logic, Other
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2023-21087: Java code in a smartphone OS can encounter a "boot loop" due to an uncaught exception
• CVE-2014-1266: Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.
Related
Observed example · CVE (2)
- CVE-2023-21087 In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. vulnerability
- CVE-2014-1266 The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security… vulnerability
Child of · CWE (1)
- CWE-691 Insufficient Control Flow Management weakness
Referenced by CVE · weakness (10)
- CVE-2026-55537 PraisonAI is a multi-agent teams system. vulnerability
- CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can… vulnerability
- CVE-2026-40208 An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame. vulnerability
- CVE-2026-10271 A flaw has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. vulnerability
- CVE-2026-3449 Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when… vulnerability
- CVE-2026-3262 A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. vulnerability
- CVE-2026-3264 A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. vulnerability
- CVE-2025-53856 When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded… vulnerability
- CVE-2024-45433 OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Incorrect Control Flow Scoping. vulnerability
- CVE-2025-9848 A security vulnerability has been detected in ScriptAndTools Real Estate Management System 1.0. vulnerability
Referenced by CWE · child of (10)
- CWE-248 Uncaught Exception weakness
- CWE-382 J2EE Bad Practices: Use of System.exit() weakness
- CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference weakness
- CWE-396 Declaration of Catch for Generic Exception weakness
- CWE-397 Declaration of Throws for Generic Exception weakness
- CWE-455 Non-exit on Failed Initialization weakness
- CWE-584 Return Inside Finally Block weakness
- CWE-617 Reachable Assertion weakness
- CWE-698 Execution After Redirect (EAR) weakness
- CWE-768 Incorrect Short Circuit Evaluation weakness