Cyber Resilience

CWE · MITRE source

CWE-395Use of NullPointerException Catch to Detect NULL Pointer Dereference

Abstraction: Base · CVEs in our corpus: 17

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

Programmers typically catch NullPointerException under three circumstances: Of these three circumstances, only the last is acceptable.

Last updated: 20 August 2026 13:14 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SA-11 Developer Testing and Evaluation
  • SA-15 Development Process, Standards, and Tools
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2025-27466 7.39.80.00472025-09-11
CVE-2025-58142 7.39.80.00472025-09-11
CVE-2022-2832 6.27.50.01692022-08-16
CVE-2025-15514 6.07.50.00712026-01-12
CVE-2024-27658 5.26.50.00642024-02-29
CVE-2024-27659 5.26.50.00642024-02-29
CVE-2024-27661 5.16.50.00432024-02-29
CVE-2024-27662 5.16.50.00432024-02-29
CVE-2022-29508 4.66.30.00172023-05-10
CVE-2022-42879 4.66.10.00212023-11-14
CVE-2024-36275 4.66.10.00212024-11-13
CVE-2023-23904 4.26.10.00142024-09-16
CVE-2023-25071 4.05.60.00182023-11-14
CVE-2023-41082 3.64.40.00222024-05-16
CVE-2023-48727 2.93.30.00242024-05-16
CVE-2022-42878 2.52.80.00192023-05-10
CVE-2024-28030 2.12.20.00182024-11-13