A10: Mishandling of Exceptional Conditions

Mishandling of Exceptional Conditions is a new category in the OWASP Top 10:2025. It covers what happens when an application fails to prevent, detect, or respond to unusual and unpredictable situations — unexpected input, missing parameters, failed dependencies, interrupted transactions, or exhausted resources. Instead of failing safely, the application crashes, leaks internal details, or continues in an inconsistent state. Attackers deliberately push applications into these edge cases, because error paths are the least tested part of most codebases: they are where authorization checks get skipped, where transactions are left half-applied, and where the server volunteers stack traces, SQL fragments, and file system paths.

Common Vulnerabilities:

• Uncaught Exceptions and Missing Error Handling (Unhandled Runtime Errors Reaching the User)
• Error Messages and Stack Traces Disclosing Sensitive Internal Information
• Failing Open Instead of Failing Securely (Denying Access Only When a Check Succeeds)
• Unchecked Return Values and Ignored Error Conditions
• Incomplete Rollback of Multi-Step Transactions After an Interruption
• Resource Leaks on the Error Path (Locks, Connections, or Temporary Files Never Released, Leading to Resource Exhaustion)
• Generic catch-All Handlers That Hide Failures Instead of Handling Them
• Missing Custom Error Pages, Exposing Default Framework or Server Error Output

To mitigate these risks, applications should validate input before it reaches business logic, handle exceptions explicitly rather than through broad catch-all blocks, and make every failure path an intentional design decision. Fail closed on security-relevant checks, release resources in finally blocks or equivalent constructs, ensure transactions roll back atomically when interrupted, and return generic error messages to users while logging full diagnostic detail internally. Testing should deliberately exercise abnormal conditions — malformed requests, missing parameters, dependency timeouts, and concurrent access — because these paths rarely appear in functional test suites.