{"@ID": "1473", "@Name": "Improper Expiration of Cached Data", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses or supports data in a cache, but it does\n\t    not properly specify an expiration with a date, time, or\n\t    time period that is sufficient for the intended security\n\t    policy of the product or its adminstrators.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "664", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": {"xhtml:p": "Developers might inadvertently omit\n\t      specifying a specific expiration for the data. With some\n\t      cache mechanisms, this could cause the data to be\n\t      labeled as having no expiration at all.", "#text_blocks": ["Developers might inadvertently omit\n\t      specifying a specific expiration for the data. With some\n\t      cache mechanisms, this could cause the data to be\n\t      labeled as having no expiration at all."]}}}, "Common_Consequences": {"Consequence": {"Scope": ["Access Control", "Integrity", "Other"], "Impact": ["Gain Privileges or Assume Identity", "Bypass Protection Mechanism", "Unexpected State", "Varies by Context"], "Note": {"xhtml:p": "If the cached data is used for\n\t      security-critical functionality such as authentication,\n\t      authorization, or identity, then this might allow users\n\t      or adversaries to perform operations beyond their\n\t      expected lifetime. If the data is old but used for\n\t      identification, such as DNS lookup results, then the\n\t      stale data could point to entities that are no longer\n\t      controlled by the intended owner.", "#text_blocks": ["If the cached data is used for\n\t      security-critical functionality such as authentication,\n\t      authorization, or identity, then this might allow users\n\t      or adversaries to perform operations beyond their\n\t      expected lifetime. If the data is old but used for\n\t      identification, such as DNS lookup results, then the\n\t      stale data could point to entities that are no longer\n\t      controlled by the intended owner."]}}}, "Potential_Mitigations": {"Mitigation": {"Phase": ["Architecture and Design", "Implementation"], "Description": {"xhtml:p": "For each type of cached data, determine the\n\t\tbest lifetime that balances efficiency provided by the\n\t\tcache with the security implications of the data\n\t\tbecoming too stale. Explicitly specify an expiration\n\t\tdate or time period.", "#text_blocks": ["For each type of cached data, determine the\n\t\tbest lifetime that balances efficiency provided by the\n\t\tcache with the security implications of the data\n\t\tbecoming too stale. Explicitly specify an expiration\n\t\tdate or time period."]}}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": {"xhtml:p": "Some JVM implementations cache DNS resolution results by default.", "#text_blocks": ["Some JVM implementations cache DNS resolution results by default."]}, "Example_Code": [{"@Nature": "Bad", "@Language": "Algorithm", "#text": "The expiry setting of the cached results might either\n\t\tbe inappropriately long for the program or set to\n\t\tnever expire."}, {"@Nature": "Good", "@Language": "Algorithm", "xhtml:p": "To mitigate this situation, the DNS cache\n\t\tsetting networkaddress.cache.ttl for the JVM needs to\n\t\tbe set appropriately.", "#text_blocks": ["To mitigate this situation, the DNS cache\n\t\tsetting networkaddress.cache.ttl for the JVM needs to\n\t\tbe set appropriately."]}], "Body_Text": {"xhtml:p": "This results in a situation where changes to\n\t\tDNS records seemingly do not take effect in the\n\t\tprogram. This could cause the product to communicate\n\t\twith IP addresses that are no longer associated with\n\t\tthe updated DNS records.", "#text_blocks": ["This results in a situation where changes to\n\t\tDNS records seemingly do not take effect in the\n\t\tprogram. This could cause the product to communicate\n\t\twith IP addresses that are no longer associated with\n\t\tthe updated DNS records."]}}}, "Observed_Examples": {"Observed_Example": {"Reference": "[REF-1581]", "Description": "RESTful search engine caches DNS hostname lookups\n\t\tforever in order to prevent DNS spoofing attacks, but\n\t\tit will not be able to detect when the hostnames\n\t\tresolve to a different IP address.", "Link": "https://github.com/elastic/elasticsearch/issues/16412"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-1579"}, {"@External_Reference_ID": "REF-1580"}, {"@External_Reference_ID": "REF-1581"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE Entry is a Class and might have lower-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Notes": {"Note": {"@Type": "Maintenance", "@Version": "5.0", "@ReleaseDate": "2026-10-28", "#text": "This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases."}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-25", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}, "Contribution": {"@Type": "Content", "Contribution_Name": "CDR contributor jharv1", "Contribution_Date": "2022-07-06", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Suggested coverage for DNS cache behavior in JVMs, which led to a demonstrative example."}}, "entry_type": "Weakness"}