CWE-691, Insufficient Control Flow Management, is a broad weakness. The code does not sufficiently manage its control flow during execution, creating conditions in which the flow can be changed in unexpected ways. The impact MITRE records is altered execution logic.
Because it is a high level entry, it is most useful as a lens. When a bug amounts to "the program did steps in the wrong order, skipped a step, or repeated a step too often," it belongs under this heading.
How it happens
The observed examples show four different flavors.
Skipped checks. CVE-2014-1266 is Apple's "goto fail" bug: an incorrect goto in an SSL product bypassed certificate validation, enabling an adversary-in-the-middle attack. MITRE labels the root cause as incorrect control flow scoping.
Wrong order. CVE-2019-9805: creation of a packet client occurs before initialization is complete, resulting in a read from uninitialized memory and memory corruption.
Loops that do not end. CVE-2011-1027: an off-by-one error leads to an infinite loop when processing invalid hex-encoded characters.
Missing limits on repetition. CVE-2024-50653: an e-commerce product does not restrict the number of requests for coupons. Nothing is memory corrupt here. The flow of the business process is simply not limited.
What an attacker gains
Whatever the skipped, reordered or repeated step was protecting. A skipped validation means a trusted connection to the wrong party. An unbounded loop means a stuck process. An unlimited coupon endpoint means a pricing system the attacker controls. The MITRE record states the consequence in one phrase, alter execution logic, and the severity follows from which logic.
How to find it
The record lists no detection methods for this broad entry. In practice:
- Read security checks as a sequence and ask what happens if any step is skipped, repeated or done early.
- Test the unhappy paths: the failing validation, the second request, the request with a step left out.
- Use compiler warnings for unreachable code, which would have flagged the code after the stray goto in the Apple case.
- Add rate limits and server side counters on any action with business value.
How to fix it
There is no mitigation text in the record for this class, so the advice follows the examples.
- Always use braces for conditionals so an extra line cannot escape the block.
- Return early on failure and make the success path explicit.
- Keep initialization complete before exposing an object.
- Bound every loop and every user triggered repeat action.
// Safer shape: braces, explicit failure, no fall through
if ((err = check_hash(ctx)) != 0) {
goto fail;
}
if ((err = check_signature(ctx)) != 0) {
goto fail;
}
Quick check
Why list a coupon limit under control flow?
Because the weakness is about a process that can be driven in a way the designer did not intend, here by repeating a step without bound.
