CWE-237 says a product does not handle, or handles incorrectly, inputs related to complex structures. It is a parent grouping, and the detail lives in its children: incomplete structural elements (CWE-238) and inconsistent ones (CWE-240).
What counts as a structure
Think of anything with parts that must fit together: a message with a header and a body, a file with a table of offsets, a request with a declared length and a payload, a nested document. The structure carries rules, and input can break them in many ways.
How it happens
Parsers are usually written against well formed examples. When a structure arrives with a part missing, a part repeated, or parts that disagree with each other, the parser needs a plan. If it has none, it ends up in a state the author never reasoned about.
The record lists the consequence as integrity: an unexpected state. The more specific entries add observed denial of service and memory disclosure.
How to find it
The record gives no detection methods. Practical options:
- Fuzz the parser with truncated, padded, nested and self contradicting structures.
- Review parsing code for every place a length, count or type field is trusted.
- Test with the malformed samples that come with the format's own specification, where they exist.
How to fix it
The record lists no mitigations. General steps:
- Validate the whole structure before acting on any part of it.
- Fail closed: if the structure is not valid, reject it and release resources.
- Set limits on size and nesting depth.
- Use a well maintained parsing library instead of writing a new one, and keep it updated.
Quick check
Which entries sit under CWE-237?
Among others, CWE-238 for incomplete structural elements and CWE-240 for inconsistent ones.
