What CVEs are caused by CWE-228?

19 recorded CVEs are attributed to CWE-228, including CVE-2024-55594, CVE-2023-42784, CVE-2021-38443.

Is CWE-228 part of the OWASP Top 10?

CWE-228 maps to OWASP Top Ten 2004: Improper Error Handling (A7) in the OWASP security taxonomy.

What are the consequences of CWE-228?

Exploiting CWE-228 can lead to: Unexpected State, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU).

Is CWE-228 actively exploited?

19 recorded CVEs are caused by CWE-228; none are currently in CISA's KEV catalog of actively exploited flaws.

Class weakness

Incomplete

CWE-228: Improper Handling of Syntactically Invalid Structure

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

CWE-228 (Improper Handling of Syntactically Invalid Structure) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

19 recorded CVEs are caused by CWE-228 (Improper Handling of Syntactically Invalid Structure). The highest-severity and most recent are shown first. 6 new CWE-228 CVEs have been recorded so far in 2026 (5 in 2025).

Showing 12 of 19 recorded CWE-228 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-228 vulnerabilities

Common consequences

What can happen when CWE-228 is exploited.

Unexpected State, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU)

Affects: Integrity, Availability

If an input is syntactically invalid, then processing the input could place the system in an unexpected state that could lead to a crash, consume available system resources or other unintended behaviors.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

This Android application has registered to handle a URL when sent an intent:

The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2004-0270 — Anti-virus product has assert error when line length is non-numeric.

Terminology & mappings

Mapped taxonomies

PLOVER: Structure and Validity Problems
OWASP Top Ten 2004: Improper Error Handling (A7) — CWE More Specific fit

Frequently asked questions

Common questions about CWE-228.

What is CWE-228?: The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
What CVEs are caused by CWE-228?: 19 recorded CVEs are attributed to CWE-228, including CVE-2024-55594, CVE-2023-42784, CVE-2021-38443.
Is CWE-228 part of the OWASP Top 10?: CWE-228 maps to OWASP Top Ten 2004: Improper Error Handling (A7) in the OWASP security taxonomy.
How is CWE-228 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-228?: Exploiting CWE-228 can lead to: Unexpected State, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU).
Is CWE-228 actively exploited?: 19 recorded CVEs are caused by CWE-228; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-228

Get alerted the moment a new CWE-228 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing