CWEweakness

CWE-755 Improper Handling of Exceptional Conditions

Medium Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Likelihood of exploit
Medium
Languages
Not Language-Specific, Python
CWE version
5.0

Description

The product does not handle or incorrectly handles an exceptional condition.

Common consequences

• Other: Other

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2023-41151: SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error • [REF-1374]: Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391) • CVE-2021-3011: virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code • CVE-2008-4302: Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.

Related

Observed example · CVE (3)

  • CVE-2023-41151 An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to… vulnerability
  • CVE-2021-3011 An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication… vulnerability
  • CVE-2008-4302 fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru… vulnerability

Child of · CWE (1)

  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness

Referenced by CVE · weakness (621)

  • CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. vulnerability
  • CVE-2026-72752 Routinator runs out of memory when the JSON output is requested many times concurrently. vulnerability
  • CVE-2026-72753 When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading… vulnerability
  • CVE-2026-72754 When Routinator encounters a CRL with many entries, it may hang or run out of memory. vulnerability
  • CVE-2026-72755 Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA… vulnerability
  • CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file… vulnerability
  • CVE-2026-72757 Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server… vulnerability
  • CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will… vulnerability
  • CVE-2026-112330 Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to… vulnerability
  • CVE-2026-112331 Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed… vulnerability
  • CVE-2026-112332 Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who… vulnerability
  • CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. vulnerability
  • CVE-2026-109619 PHP has various global state that temporarily points into request memory. vulnerability
  • CVE-2026-103936 libp2p is a JavaScript implementation of the libp2p networking stack. vulnerability
  • CVE-2026-85473 The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range… vulnerability
  • CVE-2026-41508 OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. vulnerability
  • CVE-2026-105242 Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. vulnerability
  • CVE-2026-105757 vLLM is an inference and serving engine for large language models. vulnerability
  • CVE-2026-90440 Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D… vulnerability
  • CVE-2026-94639 improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in… vulnerability
  • CVE-2026-94651 improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java… vulnerability
  • CVE-2026-96277 Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. vulnerability
  • CVE-2026-96294 Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. vulnerability
  • CVE-2026-101016 A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. vulnerability
  • CVE-2026-101017 A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. vulnerability
  • CVE-2026-101099 A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. vulnerability
  • CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. vulnerability
  • CVE-2026-63450 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. vulnerability
  • CVE-2026-54578 mport is the MidnightBSD Package Manager. vulnerability
  • CVE-2026-54580 mport is the MidnightBSD Package Manager. vulnerability
Show all 621 ›

Referenced by CWE · child of (13)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness
  • CWE-248 Uncaught Exception weakness
  • CWE-274 Improper Handling of Insufficient Privileges weakness
  • CWE-280 Improper Handling of Insufficient Permissions or Privileges weakness
  • CWE-333 Improper Handling of Insufficient Entropy in TRNG weakness
  • CWE-390 Detection of Error Condition Without Action weakness
  • CWE-392 Missing Report of Error Condition weakness
  • CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference weakness
  • CWE-396 Declaration of Catch for Generic Exception weakness
  • CWE-460 Improper Cleanup on Thrown Exception weakness
  • CWE-544 Missing Standardized Error Handling Mechanism weakness
  • CWE-636 Not Failing Securely weakness
  • CWE-756 Missing Custom Error Page weakness

Referenced by CWE · has member (1)

  • CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities view

Referenced by OWASP · mapped cwe (1)

  • A10:2025 Mishandling of Exceptional Conditions Top 10 2025