CWE-229Improper Handling of Values

Abstraction: Base · CVEs in our corpus: 18

The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.

Last updated: 04 July 2026 00:28 UTC

NIST 800-53 r5 controls that address this weakness (0)AI

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1068 Exploitation for Privilege Escalation→P T1190 Exploit Public-Facing Application→M T1203 Exploitation for Client Execution→P T1210 Exploitation of Remote Services→P T1212 Exploitation for Credential Access→P T1687 Exploitation for Defense Impairment→P

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2026-45602` UPD	7.0	9.1	0.0037	2026-06-09
`CVE-2022-22562`	5.5	7.5	0.0089	2022-04-12
`CVE-2022-24412`	5.5	7.5	0.0097	2022-04-12
`CVE-2022-2809`	5.5	8.2	0.0059	2022-10-27
`CVE-2022-3409`	5.5	8.2	0.0059	2022-10-27
`CVE-2024-36737`	5.5	7.5	0.0052	2024-06-06
`CVE-2024-39531`	5.5	7.5	0.0044	2024-07-11
`CVE-2025-59032` UPD	5.5	7.5	0.0070	2026-03-27
`CVE-2022-4851`	3.5	5.3	0.0077	2022-12-29
`CVE-2024-0607`	3.5	6.6	0.0024	2024-01-18
`CVE-2024-29460`	3.5	6.6	0.0024	2024-04-10
`CVE-2024-30917`	3.5	5.5	0.0022	2024-04-11
`CVE-2024-30800`	3.5	5.6	0.0021	2024-04-23
`CVE-2024-20431`	3.5	5.8	0.0039	2024-10-23
`CVE-2025-20268` UPD	3.5	5.8	0.0045	2025-08-14
`CVE-2025-31648`	1.6	3.9	0.0013	2026-02-10