A08:2025 Software or Data Integrity Failures

OWASP Top 10:2025 · Back to the list

Code or data is trusted without integrity verification — insecure deserialization, unsigned updates, CI/CD compromise paths.

Related on the LLM side: OWASP Top 10 for LLMs LLM04:2025.

Member CWEs (14)

CWE-345 Insufficient Verification of Data Authenticity
CWE-353 Missing Support for Integrity Check
CWE-426 Untrusted Search Path
CWE-427 Uncontrolled Search Path Element
CWE-494 Download of Code Without Integrity Check
CWE-502 Deserialization of Untrusted Data
CWE-506 Embedded Malicious Code
CWE-509 Replicating Malicious Code (Virus or Worm)
CWE-565 Reliance on Cookies without Validation and Integrity Checking
CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-830 Inclusion of Web Functionality from an Untrusted Source
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-926 Improper Export of Android Application Components

Mapped NIST 800-53 r5 controls (5)

Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

SA-17←M →P SA-8←M →P SI-2←P →P SI-3←P →P SI-7←M →P

Tagged CVEs (showing 50 most recent of 6,121)

Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1443).