The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
View on MITREPaired delimiters might include: < and > angle brackets ( and ) parentheses { and } braces [ and ] square brackets " " double quotes ' ' single quotes
Developers should anticipate that grouping elements will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
No detection method information available for this CWE.
Crash via missing paired delimiter (open double-quote but no closing double-quote).
View DetailsBuffer overflow via mailbox name with an opening double quote but missing a closing double quote, causing a larger copy than expected.
View DetailsCWE-157: Failure to Sanitize Paired Delimiters is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces. Paired delimiters might include: < and > angle brackets ( and ) parentheses { and } braces [ and ] square brackets " " double quotes ' ' single quotes
If exploited, CWE-157 (Failure to Sanitize Paired Delimiters) it can compromise Integrity, leading to outcomes such as Unexpected State.
Recommended mitigations for CWE-157 include: Developers should anticipate that grouping elements will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
CWE-157 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-157, including CVE-2004-0956, CVE-2000-1165 and CVE-2005-2933. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-157 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.