CWE-230Improper Handling of Missing Values

Abstraction: Variant · CVEs in our corpus: 12

The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 6 mapping(s) from 3 framework(s): STIG oracle linux 8 4 (partial) · STIG rhel 7 1 (partial) · STIG ubuntu 24 04 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SI-10 Information Input Validation
SI-11 Error Handling

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

7 hardening rules · 3 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-10508`	7.6	9.8	0.0152	2024-11-09
`CVE-2024-11024`	7.4	9.8	0.0068	2024-11-26
`CVE-2024-0208`	6.2	7.8	0.0184	2024-01-03
`CVE-2026-20086`	6.2	8.6	0.0035	2026-03-25
`CVE-2024-9781`	5.8	7.8	0.0031	2024-10-10
`CVE-2024-0048`	5.6	7.8	0.0013	2024-03-11
`CVE-2024-6237`	5.3	6.5	0.0092	2024-07-09
`CVE-2025-23225`	5.1	6.5	0.0043	2025-02-28
`CVE-2023-1697`	5.0	6.5	0.0032	2023-04-17
`CVE-2026-1461`	5.0	6.5	0.0023	2026-02-19
`CVE-2026-25658`	4.9	6.5	0.0016	2026-06-05
`CVE-2026-25659`	4.9	6.5	0.0016	2026-06-05