What CVEs are caused by CWE-779?

18 recorded CVEs are attributed to CWE-779, including CVE-2024-36072, CVE-2024-36416, CVE-2023-23949.

Is CWE-779 actively exploited?

18 recorded CVEs are caused by CWE-779; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Base weakness

Draft

CWE-779: Logging of Excessive Data

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

Last updated May 1, 2026

18

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Low

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

While logging is a good practice in general, and very high levels of logging are appropriate for debugging stages of development, too much logging in a production environment might hinder a system administrator's ability to detect anomalous conditions. This can provide cover for an attacker while attempting to penetrate a system, clutter the audit trail for forensic analysis, or make it more difficult to debug problems in a production environment.

Real-world CVEs

18 recorded CVEs are caused by CWE-779 (Logging of Excessive Data). The highest-severity and most recent are shown first. 4 new CWE-779 CVEs have been recorded so far in 2026 (2 in 2025).

Showing 12 of 18 recorded CWE-779 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-779 vulnerabilities

Common consequences

What can happen when CWE-779 is exploited.

DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other)

Affects: Availability

Log files can become so large that they consume excessive resources, such as disk and CPU, which can hinder the performance of the system.

Hide Activities

Affects: Non-Repudiation

Logging too much information can make the log files of less use to forensics analysts and developers when trying to diagnose a problem or recover from an attack.

Hide Activities

Affects: Non-Repudiation

If system administrators are unable to effectively process log files, attempted attacks may go undetected, possibly leading to eventual system compromise.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Operation

How to prevent it

Practical mitigations for CWE-779, grouped by where in the lifecycle they apply.

Architecture and Design

Suppress large numbers of duplicate log messages and replace them with periodic summaries. For example, syslog may include an entry that states "last message repeated X times" when recording repeated events.

Architecture and Design

Support a maximum size for the log file that can be controlled by the administrator. If the maximum size is reached, the admin should be notified. Also, consider reducing functionality of the product. This may result in a denial-of-service to legitimate product users, but it will prevent the product from adversely impacting the entire system.

Implementation

Adjust configurations appropriately when the product is transitioned from a debug state to production.

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2007-0421 — server records a large amount of data to the server log when it receives malformed headers
CVE-2002-1154 — chain: application does not restrict access to front-end for updates, which allows attacker to fill the error log

Terminology & mappings

Mapped taxonomies

ISA/IEC 62443: Req SR 7.2 (Part 3-3)
ISA/IEC 62443: Req SD-1 (Part 4-1)
ISA/IEC 62443: Req SVV-3 (Part 4-1)
ISA/IEC 62443: Req CR 7.2 (Part 4-2)

Frequently asked questions

Common questions about CWE-779.

What is CWE-779?: The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
What CVEs are caused by CWE-779?: 18 recorded CVEs are attributed to CWE-779, including CVE-2024-36072, CVE-2024-36416, CVE-2023-23949.
How do you prevent CWE-779?: Suppress large numbers of duplicate log messages and replace them with periodic summaries. For example, syslog may include an entry that states "last message repeated X times" when recording repeated events.
How is CWE-779 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-779?: Exploiting CWE-779 can lead to: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), Hide Activities.
Is CWE-779 actively exploited?: 18 recorded CVEs are caused by CWE-779; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-779

Get alerted the moment a new CWE-779 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing