The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

What CVEs are caused by CWE-670?

97 recorded CVEs are attributed to CWE-670, including CVE-2025-43359, CVE-2023-23623, CVE-2022-25745.

What are the consequences of CWE-670?

Exploiting CWE-670 can lead to: Other, Alter Execution Logic.

Is CWE-670 actively exploited?

97 recorded CVEs are caused by CWE-670; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-670: Always-Incorrect Control Flow Implementation

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

This code queries a server and displays its status when a request comes from an authorized IP address.

Vulnerable example

php

...
$requestingIP = $_SERVER['REMOTE_ADDR'];

This code redirects unauthorized users, but continues to execute code after calling http_redirect(). This means even unauthorized users may be able to access the contents of the page or perform a DoS attack on the server being queried. Also, note that this code is vulnerable to an IP address spoofing attack (CWE-212).

In this example, the programmer has indented the statements to call Do_X() and Do_Y(), as if the intention is that these functions are only called when the condition is true. However, because there are no braces to signify the block, Do_Y() will always be executed, even if the condition is false.

Vulnerable example

if (condition==true)

This might not be what the programmer intended. When the condition is critical for security, such as in making a security decision or detecting a critical error, this may produce a vulnerability.

In both of these examples, a message is printed based on the month passed into the function:

Vulnerable example

java

public void printMessage(int month){

Vulnerable example

void printMessage(int month){

Both examples do not use a break statement after each case, which leads to unintended fall-through behavior. For example, calling "printMessage(10)" will result in the text "OctoberNovemberDecember is a great month" being printed.

In the excerpt below, an AssertionError (an unchecked exception) is thrown if the user hasn't entered an email address in an HTML form.

Vulnerable example

java

String email = request.getParameter("email_address");

CWE-670: Always-Incorrect Control Flow Implementation

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Code examples

Illustrative examples

Frequently asked questions

References

Stay ahead of CWE-670

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Frequently asked questions

References

Stay ahead of CWE-670