CWE-353: Missing Support for Integrity Check

Extended Description

If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.

Code Examples & CVEs

Demonstrative Examples

In this example, a request packet is received, and privileged information is sent to the requester:

The response containing secret data has no integrity check associated with it, allowing an attacker to alter the message without detection.

BadJava

while(true) {DatagramPacket rp = new DatagramPacket(rData,rData.length);outSock.receive(rp);InetAddress IPAddress = rp.getAddress();int port = rp.getPort();out = secret.getBytes();DatagramPacket sp =new DatagramPacket(out, out.length, IPAddress, port);outSock.send(sp);}

Observed CVE Examples (1)

CVE-2025-32890

Mesh device uses a cryptographic algorithm without integrity checking, allowing modification of messages

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-353 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-353, Missing Support for Integrity Check, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Missing Support for Integrity Check during Architecture and Design

MITRE associates mitigation with Architecture and Design, and Implementation; recorded impacts include Other, and Hide Activities; the entry maps to CAPEC-13, CAPEC-14, CAPEC-389, and CAPEC-39. Use these source-defined anchors to turn CWE-353 into implementation, review, and verification checks for the affected component.

CWE-353: Missing Support for Integrity Check — MITRE CWE

Triage CWE-353 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-353, Missing Support for Integrity Check, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-353

Apply MITRE's full root-cause mapping guidance when using CWE-353, Missing Support for Integrity Check. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-353 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-353, Missing Support for Integrity Check. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-353: Missing Support for Integrity Check?+

CWE-353: Missing Support for Integrity Check is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.

What are the security consequences of Missing Support for Integrity Check?+

If exploited, CWE-353 (Missing Support for Integrity Check) it can compromise Integrity, Other and Non-Repudiation, leading to outcomes such as Other and Hide Activities.

How do you prevent or mitigate Missing Support for Integrity Check?+

Recommended mitigations for CWE-353 include: Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used. Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.

Which programming languages are affected by Missing Support for Integrity Check?+

CWE-353 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Missing Support for Integrity Check?+

MITRE documents real CVEs mapped to CWE-353, including CVE-2025-32890. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-353 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-353: Missing Support for Integrity Check

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Scope

Impact

Mitigation Strategies

Phase

Description