CWE-1074 is a class with an inheritance level that is too high, meaning it has a large number of parent classes. It affects object oriented code bases, particularly older ones that grew by adding one more subclass at a time.
How it happens
Each new requirement gets a new subclass of the nearest class. After a few years, a leaf class sits ten levels deep. To know what one method does, a developer reads every ancestor to see which one overrides what.
MITRE notes that the threshold varies by product, and that CISQ recommends a default maximum of 7 parent classes.
# Pattern to avoid: behavior spread across a long chain
class A: ...
class B(A): ...
class C(B): ...
class D(C): ...
class E(D): ...
class F(E): ...
class G(F): ...
class H(G): ... # eight levels
# Better: small pieces combined by composition
class Report:
def __init__(self, formatter, exporter, auditor):
self.formatter = formatter
self.exporter = exporter
self.auditor = auditor
What an attacker gains
MITRE lists reduced maintainability and increased analytical complexity. The issue "indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities" and "might make it easier to introduce vulnerabilities."
A concrete way this goes wrong: a security check is added to a parent method, and a child in the chain overrides it without calling the parent. The check no longer runs for that child, and with a deep chain nobody sees it.
How to find it
The record lists no detection methods. Many static analysis and metrics tools report depth of inheritance tree. Set the threshold at 7 or your own limit and review everything above it.
You can also do a manual pass: list your base classes and count how far down the longest chain goes.
How to fix it
The record lists no mitigations, so these are general steps.
- Replace inheritance with composition where classes only share code, not identity.
- Collapse layers that add nothing.
- Keep the parent's contract: overriding methods should call the parent when the parent enforces a rule.
- Add a metrics gate so new classes cannot exceed the limit.
Do these gradually. Flatten the classes that handle authentication, authorization and input validation first, because those are where hidden overrides cost the most.
Quick check
What default maximum does CISQ recommend?
7 parent classes, though what counts as too many can vary by product.
How can deep inheritance hide a security bug?
A child class can override a method that contains a check and skip the check, and the long chain makes the override easy to miss.
