CWE-1055 covers a class that inherits from more than one concrete class. It matters to anyone working in languages that allow it, such as C++ and Python, where the pattern can slip in unnoticed.
How it happens
Reuse is tempting. You need behavior from two existing classes, so you inherit from both. Now the new class carries the state and methods of two parents, and any overlap in names or assumptions becomes your problem.
# Pattern to avoid: two concrete parents
class ReportExporter(FileWriter, EmailSender):
pass
# Safer: compose, so each piece stays separate
class ReportExporter:
def __init__(self, writer, sender):
self.writer = writer
self.sender = sender
What an attacker gains
Nothing directly. MITRE lists reduced maintainability, which "indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities" and "might make it easier to introduce vulnerabilities."
How to find it
MITRE notes that automated static analysis (SAST) can find some instances by analyzing source code without running it. You can also search class definitions for more than one parent.
How to fix it
Prefer composition: hold the other behavior as a member and call it. If you need a shared contract, inherit from at most one concrete class and implement interfaces or abstract bases for the rest.
Quick check
What does static analysis do here?
It reads the source and flags classes with more than one concrete parent, without executing the program.
