424
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 228 Improper Handling of Syntactically Invalid Structure 568
ChildOf 159 Improper Handling of Invalid Use of Special Elements 411
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 19 Data Processing Errors 2309
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Crash, Exit, or Restart
Potential Mitigations
Developers should anticipate that special elements will be removed in the input vectors of
their product. Use an appropriate combination of denylists and allowlists to ensure only valid,
expected and appropriate input is processed by the system.
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2002-1362 Crash via message type without separator character
https://www.cve.org/CVERecord?id=CVE-2002-1362
CVE-2002-0729 Missing special character (separator) causes crash
https://www.cve.org/CVERecord?id=CVE-2002-0729
CVE-2002-1532 HTTP GET without \r\n\r\n CRLF sequences causes product to wait indefinitely
and prevents other users from accessing it
https://www.cve.org/CVERecord?id=CVE-2002-1532
MemberOf Relationships
CWE Version 4.14
CWE-167: Improper Handling of Additional Special Element
CWE-167: Improper Handling of Additional Special Element