What CVEs are caused by CWE-550?

5 recorded CVEs are attributed to CWE-550, including CVE-2025-62168, CVE-2023-40726, CVE-2025-36419.

What are the consequences of CWE-550?

Exploiting CWE-550 can lead to: Read Application Data.

Is CWE-550 actively exploited?

5 recorded CVEs are caused by CWE-550; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Create an account

Variant weakness

Incomplete

CWE-550: Server-generated Error Message Containing Sensitive Information

Certain conditions, such as network failure, will cause a server error message to be displayed.

Last updated May 1, 2026

5

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Variant

Abstraction

MITRE classification

Overview

While error messages in and of themselves are not dangerous, per se, it is what an attacker can glean from them that might cause eventual problems.

Real-world CVEs

5 recorded CVEs are caused by CWE-550 (Server-generated Error Message Containing Sensitive Information). The highest-severity and most recent are shown first. 2 new CWE-550 CVEs have been recorded so far in 2026 (1 in 2025).

CVE-2023-5617

Medium · CVSS 5.3 · EPSS 30th

2024-02-28

CVE-2026-101915

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Low · CVSS 3.7 · EPSS 15th

2026-09-28

Common consequences

What can happen when CWE-550 is exploited.

Read Application Data

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-550, grouped by where in the lifecycle they apply.

Architecture and Design

System Configuration

Recommendations include designing and adding consistent error handling mechanisms which are capable of handling any user input to your web application, providing meaningful detail to end-users, and preventing error messages that might provide information useful to an attacker from being displayed.

Frequently asked questions

Common questions about CWE-550.

What is CWE-550?: Certain conditions, such as network failure, will cause a server error message to be displayed.
What CVEs are caused by CWE-550?: 5 recorded CVEs are attributed to CWE-550, including CVE-2025-62168, CVE-2023-40726, CVE-2025-36419.
How do you prevent CWE-550?: Recommendations include designing and adding consistent error handling mechanisms which are capable of handling any user input to your web application, providing meaningful detail to end-users, and preventing error messages that might provide information useful to an attacker from being displayed.
What are the consequences of CWE-550?: Exploiting CWE-550 can lead to: Read Application Data.
Is CWE-550 actively exploited?: 5 recorded CVEs are caused by CWE-550; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Track CWE-550 CVEs

Get an alert when a new CWE-550 CVE affects your products, with AI-written analysis and remediation steps.

Create an account See pricing