What CVEs are caused by CWE-573?

6 recorded CVEs are attributed to CWE-573, including CVE-2026-41583, CVE-2025-21601, CVE-2026-59998.

What are the consequences of CWE-573?

Exploiting CWE-573 can lead to: Quality Degradation, Varies by Context.

Is CWE-573 actively exploited?

6 recorded CVEs are caused by CWE-573; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Class weakness

Draft

CWE-573: Improper Following of Specification by Caller

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Last updated May 1, 2026

6

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

When leveraging external functionality, such as an API, it is important that the caller does so in accordance with the requirements of the external functionality or else unintended behaviors may result, possibly leaving the system vulnerable to any number of exploits.

Real-world CVEs

6 recorded CVEs are caused by CWE-573 (Improper Following of Specification by Caller). The highest-severity and most recent are shown first. 3 new CWE-573 CVEs have been recorded so far in 2026 (2 in 2025).

2026-07-08

CVE-2025-69287

BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability

Medium · CVSS 5.4 · EPSS 21th

2026-02-18

CVE-2019-14829

Medium · CVSS 4.3 · EPSS 51th

2021-03-19

CVE-2025-46330

Snowflake Connector for C/C++ retries malformed requests

Low · CVSS 3.3 · EPSS 4th

2025-04-29

Common consequences

What can happen when CWE-573 is exploited.

Quality Degradation, Varies by Context

Affects: Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2006-7140 — Crypto implementation removes padding when it shouldn't, allowing forged signatures
CVE-2006-4339 — Crypto implementation removes padding when it shouldn't, allowing forged signatures

Terminology & mappings

Mapped taxonomies

The CERT Oracle Secure Coding Standard for Java (2011): Follow the general contract when implementing the compareTo() method (MET10-J)

Frequently asked questions

Common questions about CWE-573.

What is CWE-573?: The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
What CVEs are caused by CWE-573?: 6 recorded CVEs are attributed to CWE-573, including CVE-2026-41583, CVE-2025-21601, CVE-2026-59998.
How is CWE-573 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-573?: Exploiting CWE-573 can lead to: Quality Degradation, Varies by Context.
Is CWE-573 actively exploited?: 6 recorded CVEs are caused by CWE-573; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-573

Get alerted the moment a new CWE-573 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing