NIST 800-53 r5 · Controls catalogue · Family SI
SI-11Error Handling
Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and Reveal error messages only to {{ insert: param, si-11_odp }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 3 mapping(s) from 2 framework(s): ASVS 5.0 2 (partial) · OWASP-Web 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (5)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Restricts error message visibility to authorized recipients, directly reducing unauthorized exposure of sensitive information. |
CWE-203 | Observable Discrepancy | 854 | Prevents attackers from using observable differences in error responses to infer internal system details or state. |
CWE-209 | Generation of Error Message Containing Sensitive Information | 666 | Explicitly requires error messages to avoid including sensitive or exploitable details while still supporting corrective action. |
CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 342 | Ensures sensitive system information is not disclosed outside the intended control sphere through error output. |
CWE-204 | Observable Response Discrepancy | 161 | Eliminates distinguishable response discrepancies in error conditions that could be exploited for reconnaissance. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-47813 KEV UPD | 10.0 | 4.3 | 0.5637 | good |
CVE-2024-29059 KEV UPD | 10.0 | 7.5 | 0.9883 | good |
CVE-2023-28771 KEV | 10.0 | 9.8 | 0.9928 | good |
CVE-2021-1906 KEV | 10.0 | 6.2 | 0.0052 | good |
CVE-2013-7331 KEV | 10.0 | 6.5 | 0.5802 | good |
CVE-2025-62168 | 8.0 | 10.0 | 0.6332 | good |
CVE-2023-36933 | 8.0 | 7.5 | 0.7224 | good |
CVE-2025-27667 | 7.0 | 9.8 | 0.0062 | good |
CVE-2026-27586 | 7.0 | 9.1 | 0.0027 | good |
CVE-2024-52975 | 7.0 | 9.0 | 0.0027 | good |
CVE-2026-27809 | 7.0 | 9.1 | 0.0041 | good |
CVE-2026-22778 UPD | 7.0 | 9.8 | 0.0382 | good |
CVE-2025-10156 | 7.0 | 9.8 | 0.0143 | good |
CVE-2025-46658 UPD | 7.0 | 9.8 | 0.0035 | good |
CVE-2022-23121 | 7.0 | 9.8 | 0.0853 | good |
CVE-2024-7569 | 7.0 | 9.6 | 0.0164 | good |
CVE-2024-21733 UPD | 6.0 | 5.3 | 0.1429 | good |
CVE-2026-20101 | 5.5 | 8.6 | 0.0035 | good |
CVE-2025-2255 | 5.5 | 8.7 | 0.0028 | good |
CVE-2025-30353 | 5.5 | 8.6 | 0.0050 | good |
CVE-2025-14551 | 5.5 | 8.1 | 0.0028 | good |
CVE-2024-11864 | 5.5 | 7.5 | 0.0050 | good |
CVE-2024-56921 | 5.5 | 7.5 | 0.0047 | good |
CVE-2024-11625 | 5.5 | 7.7 | 0.0029 | good |
CVE-2026-34388 | 5.5 | 7.5 | 0.0026 | good |