CWE-1086, Class with Excessive Number of Child Classes, applies to object oriented code where one class has an unnecessarily large number of children.
MITRE notes that the number depends on the team. The CISQ standard recommends a default maximum of 10 child classes. The entry is a quality issue with no direct security implications and is prohibited for mapping real vulnerabilities.
How it happens
A base class becomes the place to hang every variation. A Handler with forty subclasses is the usual picture. Each new case adds a child instead of prompting a rethink of the design.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and increased analytical complexity. A change to the parent affects every child, so a fix to one behavior can quietly alter dozens of others. That makes security fixes riskier and slower.
How to find it
Code metrics tools report the number of children per class. A short script over your class hierarchy can do the same.
How to fix it
- Prefer composition over inheritance, so variations are plugged in rather than subclassed.
- Group children under intermediate classes that capture shared behavior.
- Replace some subclasses with data or configuration when only values differ.
- Add tests around the parent before changing it.
Quick check
Why does a wide inheritance tree affect security?
A change to the parent reaches every child, so fixes are harder to reason about. The effect is indirect, which is why MITRE treats it as a quality issue.
