A10:2025 Mishandling of Exceptional Conditions

OWASP Top 10:2025 · Back to the list

New for 2025. Error and exception paths leak information, fail open, or land in inconsistent states. Includes fail-open authentication and logic-flaw error handling.

Member CWEs (24)

CWE-209 Generation of Error Message Containing Sensitive Information
CWE-215 Insertion of Sensitive Information Into Debugging Code
CWE-234 Failure to Handle Missing Parameter
CWE-235 Improper Handling of Extra Parameters
CWE-248 Uncaught Exception
CWE-252 Unchecked Return Value
CWE-274 Improper Handling of Insufficient Privileges
CWE-280 Improper Handling of Insufficient Permissions or Privileges
CWE-369 Divide By Zero
CWE-390 Detection of Error Condition Without Action
CWE-391 Unchecked Error Condition
CWE-394 Unexpected Status Code or Return Value
CWE-396 Declaration of Catch for Generic Exception
CWE-397 Declaration of Throws for Generic Exception
CWE-460 Improper Cleanup on Thrown Exception
CWE-476 NULL Pointer Dereference
CWE-478 Missing Default Case in Multiple Condition Expression
CWE-484 Omitted Break Statement in Switch
CWE-550 Server-generated Error Message Containing Sensitive Information
CWE-636 Not Failing Securely ('Failing Open')
CWE-703 Improper Check or Handling of Exceptional Conditions
CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-755 Improper Handling of Exceptional Conditions
CWE-756 Missing Custom Error Page

Mapped NIST 800-53 r5 controls (38)

Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Tagged CVEs (showing 50 most recent of 9,146)

Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1445).