CWE VIEW: Weaknesses Addressed by the OpenSSF Secure Coding Guide for Python (2026)
 Objective Audience
RelationshipsThe following graph shows the tree-like relationships between
weaknesses that exist at different levels of abstraction. At the highest level, categories
and pillars exist to group weaknesses. Categories (which are not technically weaknesses) are
special CWE entries used to group weaknesses that share a common characteristic. Pillars are
weaknesses that are described in the most abstract fashion. Below these top-level entries
are weaknesses are varying levels of abstraction. Classes are still very abstract, typically
independent of any specific language or technology. Base level weaknesses are used to
present a more specific type of weakness. A variant is a weakness that is described at a
very low level of detail, typically limited to a specific language or technology. A chain is
a set of weaknesses that must be reachable consecutively in order to produce an exploitable
vulnerability. While a composite is a set of weaknesses that must all be present
simultaneously in order to produce an exploitable vulnerability.
Show Details:
1449 - Weaknesses Addressed by the OpenSSF Secure Coding Guide for Python (2026)
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 01 Introduction
- (1451)
Weaknesses in this category are related to the rules and recommendations in section "01 Introduction" of the OpenSSF Secure Coding Guide for Python.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
External Control of Assumed-Immutable Web Parameter
- (472)
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Assumed-Immutable Parameter Tampering
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Trust Boundary Violation
- (501)
The product mixes trusted and untrusted data in the same data structure or structured message.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Operator Precedence Logic Error
- (783)
The product uses an expression in which operator precedence causes incorrect logic to be used.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Use of Hard-coded Credentials
- (798)
The product contains hard-coded credentials, such as a password or cryptographic key.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 02 Encoding and Strings
- (1452)
Weaknesses in this category are related to the rules and recommendations in section "02 Encoding and Strings" of the OpenSSF Secure Coding Guide for Python.
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Improper Handling of Mixed Encoding
- (175)
The product does not properly handle when the same input uses several different (mixed) encodings.
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Improper Handling of Unicode Encoding
- (176)
The product does not properly handle when an input contains Unicode encoding.
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Incorrect Behavior Order: Validate Before Canonicalize
- (180)
The product validates input before it is canonicalized.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 03 Numbers
- (1453)
Weaknesses in this category are related to the rules and recommendations in section "03 Numbers" of the OpenSSF Secure Coding Guide for Python.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Incorrect Bitwise Shift of Integer
- (1335)
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Insufficient Precision or Accuracy of a Real Number
- (1339)
The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Integer Overflow or Wraparound
- (190)
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
Overflow
Wraparound
wrap, wrap-around, wrap around
Year 2038 problem, Y2K38, Y2038, Epochalypse
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Integer Underflow (Wrap or Wraparound)
- (191)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Integer underflow
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Numeric Truncation Error
- (197)
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Incorrect Conversion between Numeric Types
- (681)
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 04 Neutralization
- (1454)
Weaknesses in this category are related to the rules and recommendations in section "04 Neutralization" of the OpenSSF Secure Coding Guide for Python.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Use of Externally-Controlled Format String
- (134)
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Incomplete List of Disallowed Inputs
- (184)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Denylist / Deny List
Blocklist / Block List
Blacklist / Black List
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Handling of Highly Compressed Data (Data Amplification)
- (409)
The product does not handle or incorrectly
handles a compressed input with a very high compression ratio
that produces a large output.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Untrusted Search Path
- (426)
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Untrusted Path
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Deserialization of Untrusted Data
- (502)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Marshaling/Marshalling, Unmarshaling/Unmarshalling
Pickling, Unpickling
PHP Object Injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Special Elements used in an OS Command
- (78)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.
Shell injection
Shell metacharacters
OS Command Injection
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Access of Resource Using Incompatible Type
- (843)
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Type Confusion
Object Type Confusion
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Neutralization of Special Elements used in an SQL Command
- (89)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
SQL Injection
SQLi
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 05 Exception Handling
- (1455)
Weaknesses in this category are related to the rules and recommendations in section "05 Exception Handling" of the OpenSSF Secure Coding Guide for Python.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Declaration of Catch for Generic Exception
- (396)
Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Declaration of Throws for Generic Exception
- (397)
The product throws or raises an overly broad exception that can hide important details and produce inappropriate responses to certain conditions.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Cleanup on Thrown Exception
- (460)
The product does not clean up its state or incorrectly cleans up its state when an exception is thrown.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Return Inside Finally Block
- (584)
The code has a return statement inside a finally block.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Check for Unusual or Exceptional Conditions
- (754)
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Handling of Exceptional Conditions
- (755)
The product does not handle or incorrectly handles an exceptional condition.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 06 Logging
- (1456)
Weaknesses in this category are related to the rules and recommendations in section "06 Logging" of the OpenSSF Secure Coding Guide for Python.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Improper Output Neutralization for Logs
- (117)
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Log forging
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Generation of Error Message Containing Sensitive Information
- (209)
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Active Debug Code
- (489)
The product is released with debugging code still enabled or active.
Leftover debug code
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Insertion of Sensitive Information into Log File
- (532)
The product writes sensitive information to a log file.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Insufficient Logging
- (778)
When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 07 Concurrency
- (1457)
Weaknesses in this category are related to the rules and recommendations in section "07 Concurrency" of the OpenSSF Secure Coding Guide for Python.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Concurrent Execution using Shared Resource with Improper Synchronization
- (362)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Race Condition
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Missing Report of Error Condition
- (392)
The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Uncontrolled Resource Consumption
- (400)
The product does not properly control the allocation and maintenance of a limited resource.
Resource Exhaustion
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Insufficient Resource Pool
- (410)
The product's resource pool is not large enough to handle peak demand.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Initialization
- (665)
The product does not initialize or incorrectly initializes a resource.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Deadlock
- (833)
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 08 Coding Standards
- (1458)
Weaknesses in this category are related to the rules and recommendations in section "08 Coding Standards" of the OpenSSF Secure Coding Guide for Python.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Loop Condition Value Update within the Loop
- (1095)
The product uses a loop with a control flow condition based on
a value that is updated within the body of the loop.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Use of Same Variable for Multiple Purposes
- (1109)
The code contains a callable, block, or other code element in
which the same variable is used to control more than one unique task or store
more than one instance of data.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Unchecked Return Value
- (252)
The product does not check the return value from a method or function.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Improper Resource Shutdown or Release
- (404)
The product does not release or incorrectly releases a resource before it is made available for re-use.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Incomplete Cleanup
- (459)
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Insufficient Cleanup
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
NULL Pointer Dereference
- (476)
The product dereferences a pointer that it expects to be valid but is NULL.
NPD
null deref
NPE
nil pointer dereference
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource.
Comparison of Object References Instead of Object Contents
- (595)
The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
Reachable Assertion
- (617)
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
assertion failure
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
Improper Check or Handling of Exceptional Conditions
- (703)
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Grouping - a CWE entry that contains a set of other entries that share a common characteristic.
OpenSSF Secure Coding Guide for Python (2026) - 09 Cryptography
- (1459)
Weaknesses in this category are related to the rules and recommendations in section "09 Cryptography" of the OpenSSF Secure Coding Guide for Python.
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Use of Insufficiently Random Values
- (330)
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Vulnerability Mapping Notes Notes References View Metrics
Content
History
Components |
||||||||||||
