A10: Mishandling of Exceptional Conditions · 2025
Errors, unexpected states or resource exhaustion are handled insecurely, causing fail-open behavior, exposed information or inconsistent behavior.
Summary
Errors, unexpected states or resource exhaustion are handled insecurely, causing fail-open behavior, exposed information or inconsistent behavior.
How the attack works
An attacker triggers an error during a security check; exception handling fails open and allows access.
Example
Vulnerable · Pseudocodetry: return authorize(user)
except TimeoutError:
return TrueFix: On timeout, deny access and log the authorization failure.
Prevention
- Define explicit error handling and fail securely.
- Test exceptional paths, limits and dependency failures.
- Apply timeouts, quotas, circuit breakers and minimal error messages.