CWE-440— Expected Behavior Violation
A feature, API, or function does not perform according to its specification.— MITRE CWE catalog
53 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-440page 2 of 2
- CVE-2025-46712LOWCVSS 3.7EG 3.72025-05-08
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening …
- CVE-2024-58265LOWCVSS 3.1EG 3.12025-07-27
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
- CVE-2023-26819LOWCVSS 2.9EG 2.92025-04-19
cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.
Map vulnerabilities like CWE-440 to your infrastructure
EchelonGraph correlates every CVE — across CWE-440 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →