CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
Last updated
Overview
Programmers typically catch NullPointerException under three circumstances: The program contains a null pointer dereference. Catching the resulting exception was easier than fixing the underlying problem. The program explicitly throws a NullPointerException to signal an error condition. The code is part of a test harness that supplies unexpected input to the classes under test. Of these three circumstances, only the last is acceptable.
Real-world CVEs
17 recorded CVEs are caused by CWE-395 (Use of NullPointerException Catch to Detect NULL Pointer Dereference). The highest-severity and most recent are shown first. 1 new CWE-395 CVE has been recorded so far in 2026 (2 in 2025).