CWE-1069
Weakness AllowedEmpty Exception Block
Abstraction: Variant · Status: Incomplete
An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
Mapping guidance
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. In many cases, the use of an empty exception block may only indicate a quality issue. However, in some cases, it prevents the product from appropriately responding to security-critical events. Consider also mapping to the higher-level weakness that is resultant from this one. Note: this weakness was formerly 'Prohibited' for mapping from CWE 4.14 (2024-02-29) to CWE 4.19.1 (2026-01-21).
Modes of introduction
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.
Suggested new demonstrative examples, mitigations, and applicable platforms.
Reported CWE-391 as suggesting CWE-1069, whose mapping usage was Prohibited at the time, leading to changing CWE-1069's usage to Allowed.
updated Relationships, Type
updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations
updated Description
updated Relationships, Type
updated Mapping_Notes
updated Demonstrative_Examples, Mapping_Notes
updated Common_Consequences, Description, Time_of_Introduction
updated Mapping_Notes
updated Demonstrative_Examples, Detection_Factors
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
For every exception block add code that handles the specific exception in the way intended by the application.
No CAPEC attack patterns related to this CWE.