Mishandling of Exceptional Conditions
Programs that fail to prevent, detect, and respond to unusual situations, leading to crashes, unexpected behavior, and vulnerabilities.
What it is
Mishandling of Exceptional Conditions is new to A10:2025, replacing Server-Side Request Forgery (which dropped off the list and is now consolidated under A01:2025 Broken Access Control). The category covers improper error handling, logical errors, failing open, and other scenarios stemming from abnormal conditions that systems may encounter. It consolidates CWEs previously associated with 'poor code quality' into a more actionable category. OWASP's notable CWEs for this category: CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-234 (Failure to Handle Missing Parameter), CWE-274 (Improper Handling of Insufficient Privileges), CWE-476 (NULL Pointer Dereference), and CWE-636 (Not Failing Securely / 'Failing Open').
Common patterns
- •Error handlers that catch exceptions broadly and then ignore them, allowing the application to continue in an undefined state.
- •Failing open: when an authentication or authorization check throws, the request is allowed through instead of rejected.
- •Stack traces or full exception details returned to the client, exposing internal paths, schema, and library versions.
- •Missing input validation that lets unexpected types or formats reach downstream logic.
- •NULL pointer dereferences in languages where checks would prevent crashes (Java, C, C++, Go without proper guards).
- •Transactions that partially complete and are not rolled back when an exceptional condition interrupts them.
- •Race conditions where unexpected timing causes inconsistent state.
What Deva detects
Deva's rule pack flags catch blocks that swallow exceptions without logging or rethrowing, authentication or authorization middleware that does not fail closed on errors, and response handlers that include exception details in production responses. Transaction rollback patterns are checked across database and message-queue boundaries. NULL-check rules apply per language (e.g., kotlin nullable types, Java Optional patterns, Go nil checks before dereference).
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2024 | CrowdStrike Falcon update (July 2024) | A bad configuration update to the CrowdStrike Falcon sensor triggered a NULL pointer dereference in the kernel driver, causing roughly 8.5 million Windows systems worldwide to blue-screen. The incident demonstrated how mishandling of an exceptional condition (malformed config) at the kernel level can cascade into a global outage. Estimated direct cost exceeded 5 billion USD. |
| 2020 | Cloudflare HTTP/2 outage | A regex performance pathology combined with insufficient timeout handling caused widespread Cloudflare-served sites to return 500 errors. The exceptional condition (catastrophic backtracking) was not handled with appropriate circuit-breaker logic at the edge. |
Compliance framework impact
- •NIST 800-53 SI-11 Error Handling, SI-10 Information Input Validation
- •PCI-DSS v4.0 Req 6.5.5 Improper error handling and data integrity
- •CMMC 2.0 SI.L2-3.14.1 Flaw remediation
- •NIST SSDF PW.8 (secure error handling in development practices)
Deva detects the mishandling of exceptional conditions patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.