What CVEs are caused by CWE-392?

10 recorded CVEs are attributed to CWE-392, including CVE-2025-32743, CVE-2023-42444, CVE-2017-2342.

What are the consequences of CWE-392?

Exploiting CWE-392 can lead to: Varies by Context, Unexpected State.

Is CWE-392 actively exploited?

10 recorded CVEs are caused by CWE-392; none are currently in CISA's KEV catalog of actively exploited flaws.

Base weakness

Draft

CWE-392: Missing Report of Error Condition

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-392 (Missing Report of Error Condition) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

10 recorded CVEs are caused by CWE-392 (Missing Report of Error Condition). The highest-severity and most recent are shown first. 2 new CWE-392 CVEs have been recorded so far in 2026 (5 in 2025).

Common consequences

What can happen when CWE-392 is exploited.

Varies by Context, Unexpected State

Affects: Integrity, Other

Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even if an error occurs.

Vulnerable example

java

try {

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2024-52316 — Web-based product can throw an exception during authentication but does not report the failure in the HTTP status code, allowing authentication bypass.
CVE-2004-0063 — Function returns "OK" even if another function returns a different status code than expected, leading to accepting an invalid PIN number.
CVE-2002-1446 — Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.
CVE-2002-0499 — Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.
CVE-2005-2459 — Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.

Terminology & mappings

Mapped taxonomies

PLOVER: Missing Error Status Code
The CERT Oracle Secure Coding Standard for Java (2011): Ensure that tasks executing in a thread pool do not fail silently (TPS03-J)
Software Fault Patterns: Incorrect Exception Behavior (SFP6)

Frequently asked questions

Common questions about CWE-392.

What is CWE-392?: The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
What CVEs are caused by CWE-392?: 10 recorded CVEs are attributed to CWE-392, including CVE-2025-32743, CVE-2023-42444, CVE-2017-2342.
What are the consequences of CWE-392?: Exploiting CWE-392 can lead to: Varies by Context, Unexpected State.
Is CWE-392 actively exploited?: 10 recorded CVEs are caused by CWE-392; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-392

Get alerted the moment a new CWE-392 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing