CWE-238 covers a product that does not handle, or handles incorrectly, a structural element that is not completely specified. Its sibling entry for plain elements is CWE-239, which has more observed examples.
How it happens
A parser reads a header, expects a body, and the body never arrives. Or the body arrives cut short. Or a closing marker is missing from a nested structure.
A careful parser notices and rejects the input. A careless one keeps waiting, reads past the end of what it has, or fills in values from leftover state.
What an attacker gains
MITRE lists an integrity impact through an unexpected state. No observed CVEs are attached to this entry in the record. For the concrete outcomes seen in practice, see the child level behavior described under CWE-239: services that wait forever for the rest of a message and stop serving other users.
How to find it
The record lists no detection methods.
- Truncate valid samples at every byte boundary and feed them in.
- Open a connection, send a partial message, and leave it idle.
- Run a fuzzer that mutates length and terminator fields.
How to fix it
The record lists no mitigations. General guidance:
- Enforce timeouts on partial input.
- Check that the bytes available match the bytes the structure claims.
- Reject incomplete structures and free what was allocated for them.
- Cap how long, and how many, half finished requests a client may hold open.
Quick check
What is the simplest test for this weakness?
Cut a valid input short at different points and confirm the product rejects it cleanly without hanging or crashing.
