{"@ID": "1069", "@Name": "Empty Exception Block", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Incomplete", "Description": "An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "1071", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Indirect"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Common_Consequences": {"Consequence": {"Scope": "Other", "Impact": "Reduce Reliability", "Note": "When an exception handling block (such as a Catch and Finally block) is used, but that block is empty, this can prevent the product from running reliably.  If the relevant code is reachable by an attacker, then this reliability problem might introduce a vulnerability."}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Implementation", "Description": "For every exception block add code that handles the specific exception in the way intended by the application."}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "The following code excerpt ignores a rarely-thrown exception from doExchange().", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": [{"@style": "margin-left:1em;", "#text": "doExchange();"}, {"@style": "margin-left:1em;", "xhtml:i": "// this can never happen"}], "xhtml:br": null, "#text": "try\n\t       {}\n\t       catch (RareException e) {\n\t       }"}, "#text_blocks": ["try\n\t       {", "doExchange();", "}", "catch (RareException e) {", "// this can never happen", "}"]}, "Body_Text": "If a RareException were to ever be thrown,\n             the program would continue to execute as though nothing\n             unusual had occurred. The program records no evidence\n             indicating the special situation, potentially\n             frustrating any later attempt to explain the program's\n             behavior."}, {"@Demonstrative_Example_ID": "DX-213", "Intro_Text": "In the following Java example, the code catches an ArithmeticException.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "c = a / b;"}, "#text": "int a = 1;\n                        int b = 0;\n                        int c = 0;\n                        try {\n                           \n                        } catch(ArithmeticException ae) {\n                        }"}, "xhtml:br": null, "#text": "public static void main(String[] args) {\n                        \n                     }"}, "#text": "public class Main {\n                     \n                  }"}, "#text_blocks": ["public class Main {", "public static void main(String[] args) {", "int a = 1;", "int b = 0;", "int c = 0;", "try {", "c = a / b;", "} catch(ArithmeticException ae) {", "}", "}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "c = a / b;"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "log.error(\"Divided by zero detected, setting to -1.\");\n                           c = -1;"}], "#text": "int a = 1;\n                        int b = 0;\n                        int c = 0;\n                        try {\n                           \n                        } catch(ArithmeticException ae) {\n                           \n                        }"}, "xhtml:br": null, "#text": "public static void main(String[] args) {\n                        \n                     }"}, "#text": "public class Main {\n                     \n                  }"}, "#text_blocks": ["public class Main {", "public static void main(String[] args) {", "int a = 1;", "int b = 0;", "int c = 0;", "try {", "c = a / b;", "} catch(ArithmeticException ae) {", "log.error(\"Divided by zero detected, setting to -1.\");", "c = -1;", "}", "}", "}"]}], "Body_Text": ["Since the exception block is empty, no action is taken.", "In the code below the exception has been logged and the bad execution has been handled in the desired way allowing the program to continue in an expected way."]}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "OMG ASCRM", "Entry_ID": "ASCRM-RLB-1"}}, "References": {"Reference": {"@External_Reference_ID": "REF-961", "@Section": "ASCRM-RLB-1"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to\n           ensure that this mapping is an appropriate fit. Do not try\n           to 'force' a mapping to a lower-level Base/Variant simply\n           to comply with this preferred level of abstraction. In many\n           cases, the use of an empty exception block may only\n           indicate a quality issue. However, in some cases, it\n           prevents the product from appropriately responding to\n           security-critical events. Consider also mapping to the\n           higher-level weakness that is resultant from this\n           one. Note: this weakness was formerly 'Prohibited' for\n           mapping from CWE 4.14 (2024-02-29) to CWE 4.19.1\n           (2026-01-21).", "Reasons": {"Reason": [{"@Type": "Acceptable-Use"}, {"@Type": "Other"}]}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2018-07-02", "Submission_Version": "3.2", "Submission_ReleaseDate": "2019-01-03", "Submission_Comment": "Entry derived from Common Quality Enumeration (CQE) Draft 0.9."}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-02-29", "Modification_Version": "4.14", "Modification_ReleaseDate": "2024-02-29", "Modification_Comment": "updated Demonstrative_Examples, Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Common_Consequences, Description, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Demonstrative_Examples, Detection_Factors"}], "Contribution": [{"@Type": "Content", "Contribution_Name": "Drew Buttner", "Contribution_Organization": "MITRE", "Contribution_Date": "2022-08-15", "Contribution_Version": "4.9", "Contribution_ReleaseDate": "2022-10-13", "Contribution_Comment": "Suggested new demonstrative examples, mitigations, and applicable platforms."}, {"@Type": "Feedback", "Contribution_Name": "Daniel \"acepace\" Goldberg", "Contribution_Organization": "Tenzai", "Contribution_Date": "2026-04-07", "Contribution_Version": "4.20", "Contribution_ReleaseDate": "2026-04-30", "Contribution_Comment": "Reported CWE-391 as suggesting CWE-1069, whose mapping usage was Prohibited at the time, leading to changing CWE-1069's usage to Allowed."}]}, "entry_type": "Weakness"}