CWE-1044 says the product's architecture contains too many, or too few, horizontal layers. Layers here are the stacked tiers of a design, such as presentation, service, domain and data access. MITRE lists it as a Base weakness for any language.
How it happens
Too few layers means concerns get mixed. A web handler talks directly to the database, and validation, business rules and storage code sit together. Too many layers means a simple change passes through a long chain of wrappers, each adding its own conventions.
MITRE says the right range varies, and that CISQ recommends a default minimum of 4 layers and a maximum of 8.
The recorded consequence is reduced maintainability. The issue makes the product harder to maintain, which indirectly affects security by making vulnerabilities harder and slower to find and fix. It might also make it easier to introduce them. No CVEs are observed.
A practical example: when validation lives in one clear layer, you can audit it once. When it is smeared across a dozen thin layers, a gap is easy to miss.
How to find it
MITRE lists no detection methods. Architecture review and dependency diagrams show the layers. Count them and look for calls that skip layers.
How to fix it
MITRE lists no formal mitigations. Reasonable steps:
- Draw the actual layers, not the intended ones.
- Merge layers that only pass calls through.
- Split layers that mix unrelated concerns.
- Put security controls, such as input validation and authorization, in an identified layer.
Quick check
What range does CISQ suggest?
A default of at least 4 and at most 8 horizontal layers, though MITRE says it varies by product.
