mishandling-exceptional-conditions

OWASP A10:2025 — Mishandling of Exceptional Conditions

Brand new category for 2025, replacing SSRF (absorbed into A01). Contains 24 CWEs with 769,581 recorded occurrences. Addresses programs that fail to prevent, detect, and respond to unusual situations — leading to crashes, unexpected behaviour, information disclosure, and exploitable states.

---

Core Concepts

What It Covers

Weakness	Risk
Improper error handling	Unhandled exceptions crash the app or expose internals
Failing open (CWE-636)	Auth/authz checks that pass when an exception is thrown
Sensitive data in error messages (CWE-209)	Stack traces, DB details, file paths leaked to clients
Uncaught exceptions (CWE-248)	No global safety net → 500 with debug output
Resource exhaustion in exception paths	DB connections, file handles never closed on error
State corruption	Partial transactions committed on exception
NULL pointer / None dereference (CWE-476)	Missing guard for None before attribute access
Missing default cases (CWE-754)	if/elif chains with no else; match with no wildcard
Race conditions in error recovery	Cleanup logic itself can be interrupted

Prevention Principles

1. Catch errors where they occur — at the function that can handle them, not three layers up.
2. Fail closed — when auth/authz logic throws, deny access; never pass through.
3. Roll back completely — partial DB transactions must be rolled back, never committed.
4. Separate user messages from technical details — log the stack trace server-side; return a safe, generic message to the client.
5. Global exception handler as safety net — every app needs one, but it is not a substitute for local handling.
6. Rate-limit and quota — prevent exceptional conditions (e.g., resource exhaustion) from being triggered intentionally.

---

FastAPI Testing Checklist

1. Global Exception Handler

# REQUIRED — catches anything not handled locally
@app.exception_handler(Exception)
async def global_handler(request: Request, exc: Exception):
    logger.error("Unhandled exception", exc_info=exc)
    return JSONResponse(status_code=500, content={"detail": "Internal server error"})

Flag if absent. The default FastAPI 500 response may include traceback in development mode.