Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
View on MITREMultiple catch blocks can get ugly and repetitive, but "condensing" catch blocks by catching a high-level class like Exception can obscure exceptions that deserve special treatment or that should not be caught at this point in the program. Catching an overly broad exception essentially defeats the purpose of a language's typed exceptions, and can become particularly dangerous if the program grows and begins to throw new types of exceptions. The new exception types will not receive any attention.
A generic exception can hide details about unexpected adversary activities by making it difficult to properly troubleshoot error conditions during execution.
No mitigation information available for this CWE.
No detection method information available for this CWE.
The following code excerpt handles three types of exceptions in an identical fashion.
At first blush, it may seem preferable to deal with these exceptions in a single catch block, as follows:
try {doExchange();}catch (IOException e) {logger.error("doExchange failed", e);}catch (InvocationTargetException e) { logger.error("doExchange failed", e); }catch (SQLException e) { logger.error("doExchange failed", e); }The following code excerpt handles three types of exceptions in an identical fashion.
At first blush, it may seem preferable to deal with these exceptions in a single catch block, as follows:
try {doExchange();}catch (Exception e) {logger.error("doExchange failed", e);}Additional facts reviewed against primary or authoritative security sources.
Documented detection approaches include Automated Static Analysis; recorded impacts include Hide Activities; related weaknesses include CWE-705, CWE-755, and CWE-221. Use these source-defined anchors to turn CWE-396 into implementation, review, and verification checks for the affected component.
CWE-396: Declaration of Catch for Generic Exception — MITRE CWEUse NIST SSDF practices to make prevention of CWE-396, Declaration of Catch for Generic Exception, an explicit development outcome. Translate the CWE definition into security requirements and design constraints, choose safer implementation patterns and toolchain checks, and define acceptance evidence before release. Feed every confirmed occurrence back into the requirements, design review, and coding rules so the same root cause is removed across the product rather than patched in one location.
NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and TechnologyUse CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-396, Declaration of Catch for Generic Exception, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.
Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security AgencyApply MITRE's full root-cause mapping guidance when using CWE-396, Declaration of Catch for Generic Exception. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.
CVE to CWE Root Cause Mapping Guidance — MITRE CWEApply MITRE's root-cause mapping quick tips to CWE-396, Declaration of Catch for Generic Exception. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.
CVE to CWE Root Cause Mapping Quick Tips — MITRE CWECWE-396: Declaration of Catch for Generic Exception is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities. Multiple catch blocks can get ugly and repetitive, but "condensing" catch blocks by catching a high-level class like Exception can obscure exceptions that deserve special treatment or that should not be caught at this point in the program. Catching an overly broad exception essentially defeats the purpose of a language's typed exceptions, and can become particularly dangerous if the program grows and begins to throw new types of exceptions. The new exception types will not receive any attention.
If exploited, CWE-396 (Declaration of Catch for Generic Exception) it can compromise Non-Repudiation and Other, leading to outcomes such as Hide Activities.
CWE-396 commonly affects C++, Java, C# and Python. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-396 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.