Mishandling of Exceptional Conditions
New in 2025, replacing SSRF's old slot (SSRF now sits under broken access control). OWASP maps 24 CWEs around improper error handling, failing open, and logic errors that appear only on abnormal conditions: timeouts, partial writes, parser failures, and…
OWASP rank: 10
Practical checks
- Compare the happy path with timeout, empty body, oversized body, and duplicate-parameter cases on a feature you own
- Watch for fail-open: an error response that still applies the change or still issues the token
- Note where an exception handler has a weaker auth check than the main handler
- Race and retry behavior belongs here when the exception is 'the first request did not finish'
- Show the state change, not only the error string