CWE-253
AllowedIncorrect Check of Function Return Value
Abstraction: Base · Status: Incomplete
The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
38 vulnerabilities reference this CWE, most recent first.
GHSA-H443-HX93-M7QC
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-30 03:37In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix ld_{abs,ind} failure path analysis in subprogs
Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types.
The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed.
This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side.
{
"affected": [],
"aliases": [
"CVE-2026-53090"
],
"database_specific": {
"cwe_ids": [
"CWE-253"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:23Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix ld_{abs,ind} failure path analysis in subprogs\n\nUsage of ld_{abs,ind} instructions got extended into subprogs some time\nago via commit 09b28d76eac4 (\"bpf: Add abnormal return checks.\"). These\nare only allowed in subprograms when the latter are BTF annotated and\nhave scalar return types.\n\nThe code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +\nexit) from legacy cBPF times. While the enforcement is on scalar return\ntypes, the verifier must also simulate the path of abnormal exit if the\npacket data load via ld_{abs,ind} failed.\n\nThis is currently not the case. Fix it by having the verifier simulate\nboth success and failure paths, and extend it in similar ways as we do\nfor tail calls. The success path (r0=unknown, continue to next insn) is\npushed onto stack for later validation and the r0=0 and return to the\ncaller is done on the fall-through side.",
"id": "GHSA-h443-hx93-m7qc",
"modified": "2026-06-30T03:37:13Z",
"published": "2026-06-24T18:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53090"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-53090"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492305"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d846d83bdacbd8f14fc45c63b8c1d22608452e1c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ee861486e377edc55361c08dcbceab3f6b6577bd"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53090.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HMG2-5H4J-37M9
Vulnerability from github – Published: 2026-04-01 15:31 – Updated: 2026-05-26 18:31A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in totemudp/totemudpu mode, which is the default configuration.
{
"affected": [],
"aliases": [
"CVE-2026-35091"
],
"database_specific": {
"cwe_ids": [
"CWE-253"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-01T14:16:57Z",
"severity": "HIGH"
},
"details": "A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents. This vulnerability affects Corosync when running in totemudp/totemudpu mode, which is the default configuration.",
"id": "GHSA-hmg2-5h4j-37m9",
"modified": "2026-05-26T18:31:36Z",
"published": "2026-04-01T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35091"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453813"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453169"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-35091"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20916"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19200"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19043"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14216"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14215"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14214"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14213"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14212"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14211"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14210"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14205"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13673"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13657"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13644"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MW35-24GH-F82W
Vulnerability from github – Published: 2017-11-15 20:41 – Updated: 2023-09-08 19:56It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "keycloak-connect"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "keycloak-js"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-7474"
],
"database_specific": {
"cwe_ids": [
"CWE-253"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:47:26Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.",
"id": "GHSA-mw35-24gh-f82w",
"modified": "2023-09-08T19:56:20Z",
"published": "2017-11-15T20:41:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7474"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1445271"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2017-1203.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "keycloak-connect and keycloak-js improperly handle invalid tokens"
}
GHSA-P54W-FQQ6-5G63
Vulnerability from github – Published: 2024-10-08 18:33 – Updated: 2024-10-08 18:33Windows Hyper-V Denial of Service Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-43521"
],
"database_specific": {
"cwe_ids": [
"CWE-253"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-08T18:15:15Z",
"severity": "HIGH"
},
"details": "Windows Hyper-V Denial of Service Vulnerability",
"id": "GHSA-p54w-fqq6-5g63",
"modified": "2024-10-08T18:33:15Z",
"published": "2024-10-08T18:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43521"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43521"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q9MV-48MG-VV6W
Vulnerability from github – Published: 2024-07-01 18:32 – Updated: 2024-10-15 21:30In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.
{
"affected": [],
"aliases": [
"CVE-2024-36985"
],
"database_specific": {
"cwe_ids": [
"CWE-253",
"CWE-687"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T17:15:06Z",
"severity": "HIGH"
},
"details": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the \u201csplunk_archiver\u201c application.",
"id": "GHSA-q9mv-48mg-vv6w",
"modified": "2024-10-15T21:30:36Z",
"published": "2024-07-01T18:32:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36985"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2024-0705"
},
{
"type": "WEB",
"url": "https://research.splunk.com/application/8598f9de-bba8-42a4-8ef0-12e1adda4131"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VH9J-8VW4-5HP6
Vulnerability from github – Published: 2024-01-24 18:31 – Updated: 2024-01-30 21:30An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
{
"affected": [],
"aliases": [
"CVE-2023-52040"
],
"database_specific": {
"cwe_ids": [
"CWE-253",
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-24T18:15:08Z",
"severity": "CRITICAL"
},
"details": "An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.",
"id": "GHSA-vh9j-8vw4-5hp6",
"modified": "2024-01-30T21:30:28Z",
"published": "2024-01-24T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52040"
},
{
"type": "WEB",
"url": "https://github.com/Beckaf/vunl/blob/main/TOTOLINK/X6000R/3/3.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VP6Q-MV9J-J428
Vulnerability from github – Published: 2026-04-22 18:31 – Updated: 2026-07-06 19:27Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4x34-chg5-mwjj. This link is maintained to preserve external references.
Original Description
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "coreutils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-253"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-29T22:50:01Z",
"nvd_published_at": "2026-04-22T17:16:35Z",
"severity": "MODERATE"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4x34-chg5-mwjj. This link is maintained to preserve external references.\n\n### Original Description\nThe recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as \u0027Operation not permitted\u0027. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.",
"id": "GHSA-vp6q-mv9j-j428",
"modified": "2026-07-06T19:27:28Z",
"published": "2026-04-22T18:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35339"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/9793"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/abd581f62e97d0b147306ac40eac13af71c6fbba"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: uutils coreutils incorrectly handles exit codes when processing multiple files",
"withdrawn": "2026-07-06T19:27:28Z"
}
GHSA-WQ52-W6CX-5MG2
Vulnerability from github – Published: 2026-05-14 03:32 – Updated: 2026-05-14 06:31Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
{
"affected": [],
"aliases": [
"CVE-2026-46419"
],
"database_specific": {
"cwe_ids": [
"CWE-253"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T02:17:21Z",
"severity": "HIGH"
},
"details": "Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function\u0027s return value in the second factor flow, leading to impersonation.",
"id": "GHSA-wq52-w6cx-5mg2",
"modified": "2026-05-14T06:31:32Z",
"published": "2026-05-14T03:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46419"
},
{
"type": "WEB",
"url": "https://github.com/Yubico/java-webauthn-server/releases/tag/2.8.2"
},
{
"type": "WEB",
"url": "https://www.yubico.com/support/security-advisories/ysa-2026-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Language Selection
Use a language or compiler that uses exceptions and requires the catching of those exceptions.
Mitigation
Properly check all functions which return a value.
Mitigation
When designing any function make sure you return a value or throw an exception in case of an error.
No CAPEC attack patterns related to this CWE.