Security Resilience

CWE · MITRE source

CWE-346Origin Validation Error

Abstraction: Class · CVEs in our corpus: 835

The product does not properly verify that the source of data or communication is valid.

Last updated: 16 October 2026 07:24 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 3 mapping(s) from 1 framework(s): STIG oracle linux 8 3 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-11 Trusted Path
  • SC-20 Secure Name/Address Resolution Service (Authoritative Source)
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-23 Session Authenticity
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (5)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Showing the 4 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SC-11Trusted PathSCTrusted path establishment enforces validation that the communication originates from and reaches only the intended trusted system components.
SC-20Secure Name/Address Resolution Service (Authoritative Source)SCEnforces validation of the true origin of DNS responses via signatures and chain-of-trust mechanisms.
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)SCEnforces origin validation of name/address data, eliminating reliance on unverified or impersonated DNS sources.
IA-9Service Identification and AuthenticationIARequires unique identification of the service before communications, addressing failures to validate the origin of the interaction.
Show 1 more broadly-applicable controls
SC-23Session AuthenticitySCMandates origin validation so that only legitimate endpoints can continue the authenticated session.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-29711 9.89.80.70312023-06-22
CVE-2015-4495 KEV 9.28.80.68562015-08-08
CVE-2025-34291 KEV 9.28.80.92812025-12-05
CVE-2020-16952 9.18.60.71092020-10-16
CVE-2024-23898 9.08.80.67152024-01-24
CVE-2000-1218 8.09.80.06212000-04-14
CVE-2019-8069 7.99.80.04272019-09-12
CVE-2019-3980 7.99.80.05142019-10-08
CVE-2018-15723 7.89.80.03702018-12-20
CVE-2021-37705 7.810.00.02422021-08-13
CVE-2023-33443 7.89.80.03502023-06-08
CVE-2025-69258 7.89.80.03572026-01-08
CVE-2021-26291 7.79.10.08692021-04-23
CVE-2019-16517 7.69.80.01342020-01-23
CVE-2003-0174 7.59.80.00982003-05-12
CVE-2018-5116 7.59.80.01172018-06-11
CVE-2018-5409 7.59.80.01082019-05-08
CVE-2019-15020 7.59.80.00892019-10-09
CVE-2020-26527 7.59.80.00912020-10-02
CVE-2017-6519 7.49.10.03242017-05-01
CVE-2017-20146 7.49.80.00742022-12-27
CVE-2023-29728 7.49.80.00582023-05-30
CVE-2026-42901 7.410.00.00462026-05-22
CVE-2026-59971 7.410.00.00422026-09-15
CVE-2017-13274 7.39.80.00492018-04-04