CWE-1121 is code whose McCabe cyclomatic complexity exceeds a desirable maximum. McCabe's measure counts the independent paths through a piece of code, which in practice grows with each branch, loop and condition.
MITRE marks it as a quality issue with no direct security implications and prohibits using it to map real vulnerabilities. It is a child of the general excessive code complexity entry, CWE-1120.
How it happens
Every new condition adds a path. A function that handles ten input variants with nested branches can have hundreds of distinct paths, more than any test suite will cover.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and increased analytical complexity, because the issue makes the product harder to understand and maintain, which indirectly affects security by making it more difficult or time-consuming to find and fix vulnerabilities, and might make them easier to introduce.
The practical link to security is testing. A higher path count means more combinations that go untested, and untested paths are where bugs hide.
How to find it
MITRE notes static analysis can find some instances. Most linters and analysis tools report cyclomatic complexity per function. Set a limit, and review everything above it, starting with code that handles untrusted input.
How to fix it
The record has no formal mitigations. Reduce the count by splitting a function into smaller ones, using early returns, replacing condition chains with tables, and removing branches that can never be taken. Add the check to CI so the number does not creep back up.
Quick check
What does cyclomatic complexity count?
The number of independent paths through code, which rises with each branch and loop.
