CWE · MITRE source
CWE-324Use of a Key Past its Expiration Date
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
While the expiration of keys does not necessarily ensure that they are compromised, it is a significant concern that keys which remain in use for prolonged periods of time have a decreasing probability of integrity. For this reason, it is important to replace keys within a period of time proportional to their strength.
Last updated: 21 August 2026 14:15 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A04:2025 Cryptographic Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls that address this weakness (1)AI-assisted
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-12 | Cryptographic Key Establishment and Management | SC | Key-management requirements enforce lifecycle controls that prevent continued use of expired or superseded keys. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2022-35401 UPD | 7.4 | 8.1 | 0.2085 | 2023-01-10 |
CVE-2024-36031 UPD | 7.4 | 9.8 | 0.0075 | 2024-05-30 |
CVE-2021-33020 UPD | 6.3 | 8.2 | 0.0063 | 2022-04-01 |
CVE-2025-31123 UPD | 6.2 | 8.7 | 0.0037 | 2025-03-31 |
CVE-2025-2291 UPD | 6.1 | 8.1 | 0.0035 | 2025-04-16 |
CVE-2026-39923 | 6.0 | 8.1 | 0.0026 | 2026-08-05 |
CVE-2022-2447 UPD | 5.2 | 6.6 | 0.0062 | 2022-09-01 |
CVE-2022-24732 UPD | 5.0 | 6.3 | 0.0041 | 2022-03-09 |
CVE-2026-52809 | 5.0 | 6.8 | 0.0015 | 2026-06-24 |
CVE-2019-3790 UPD | 4.9 | 6.1 | 0.0066 | 2019-06-06 |
CVE-2024-25679 UPD | 4.9 | 6.5 | 0.0025 | 2024-02-09 |
CVE-2025-48813 UPD | 4.7 | 6.3 | 0.0023 | 2025-10-14 |
CVE-2025-33012 UPD | 4.7 | 6.3 | 0.0016 | 2025-11-07 |
CVE-2024-38277 UPD | 4.3 | 5.4 | 0.0024 | 2024-06-18 |
CVE-2025-13723 | 4.2 | 5.3 | 0.0017 | 2026-03-13 |
CVE-2024-7318 UPD | 4.0 | 4.8 | 0.0039 | 2024-09-09 |
CVE-2024-6299 UPD | 3.8 | 4.8 | 0.0016 | 2024-06-25 |
CVE-2024-31893 UPD | 3.6 | 4.3 | 0.0026 | 2024-05-22 |
CVE-2024-31894 UPD | 3.6 | 4.3 | 0.0026 | 2024-05-22 |
CVE-2024-31895 UPD | 3.6 | 4.3 | 0.0027 | 2024-05-22 |
CVE-2023-5342 UPD | 3.1 | 4.1 | 0.0008 | 2025-08-14 |
CVE-2026-54787 | 2.5 | 3.1 | 0.0009 | 2026-07-31 |