Base weakness
Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
Last updated
Multiple catch blocks can get ugly and repetitive, but "condensing" catch blocks by catching a high-level class like Exception can obscure exceptions that deserve special treatment or that should not be caught at this point in the program. Catching an overly broad exception essentially defeats the purpose of a language's typed exceptions, and can become particularly dangerous if the program grows and begins to throw new types of exceptions. The new exception types will not receive any attention.
2 recorded CVEs are caused by CWE-396 (Declaration of Catch for Generic Exception). The highest-severity and most recent are shown first. 2 new CWE-396 CVEs have been recorded so far in 2026.
PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls
Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
What can happen when CWE-396 is exploited.
Hide Activities
Affects: Non-Repudiation, Other
A generic exception can hide details about unexpected adversary activities by making it difficult to properly troubleshoot error conditions during execution.
Typically introduced during these phases of the software lifecycle.
Languages
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Illustrative examples from MITRE showing how the weakness appears in code.
The following code excerpt handles three types of exceptions in an identical fashion.
Safe example
try {Vulnerable example
try {Common questions about CWE-396.
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Get alerted the moment a new CWE-396 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.