Common Weakness Enumeration
CWE-827
Weakness AllowedImproper Control of Document Type Definition
Abstraction: Variant · Status: Incomplete
The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
As DTDs are processed, they might try to read or include files on the machine performing the parsing. If an attacker is able to control the DTD, then the attacker might be able to specify sensitive resources or requests or provide malicious content.
For example, the SOAP specification prohibits SOAP messages from containing DTDs.
Mapping guidance
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Content history
Submission: CWE Content Team
· MITRE
· 2010-10-25
· CWE 1.11
Modification: CWE Content Team
· MITRE
· 2011-03-29
· CWE 1.12
updated Relationships
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2013-02-21
· CWE 2.4
updated Applicable_Platforms
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Modes_of_Introduction, Relationships
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Type
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Applicable_Platforms, Relationships
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Weakness_Ordinalities
4 vulnerabilities reference this CWE, most recent first.
CVE-2026-15803 (GCVE-0-2026-15803)
Vulnerability from cvelistv5 – Published: 2026-08-12 15:38 – Updated: 2026-08-13 15:22
VLAI
EPSS
VEX
Summary
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:37 UTC
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse RDF4J |
Affected:
0 , < 5.3.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:37:16.500730Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:37:30.325Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse RDF4J",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "5.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Herrmann (rwx)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default.\u003c/p\u003e"
}
],
"value": "In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for CVE-2018-1000644: the earlier fix did not cover all parser entry points. The issue is resolved in RDF4J 5.3.2, which rejects or disables DOCTYPE declarations, external entities, and external DTD loading by default."
}
],
"impacts": [
{
"capecId": "CAPEC-201",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-201"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-827",
"description": "CWE-827",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:22:54.290Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://rdf4j.org/release-notes/5.3.2/"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/175"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-15803",
"datePublished": "2026-08-12T15:38:30.997Z",
"dateReserved": "2026-07-15T07:09:46.461Z",
"dateUpdated": "2026-08-13T15:22:54.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-4949 (GCVE-0-2025-4949)
Vulnerability from cvelistv5 – Published: 2025-05-21 06:47 – Updated: 2025-10-14 06:30
VLAI
EPSS
VEX
Title
XXE vulnerability in Eclipse JGit
Summary
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-21 10:22 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://projects.eclipse.org/projects/technology.… | release-notes |
| https://projects.eclipse.org/projects/technology.… | release-notes |
| https://projects.eclipse.org/projects/technology.… | release-notes |
| https://projects.eclipse.org/projects/technology.… | release-notes |
| https://gitlab.eclipse.org/security/vulnerability… | issue-tracking |
| https://gitlab.eclipse.org/security/cve-assigneme… | issue-tracking |
| https://projects.eclipse.org/projects/technology.… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse JGit | Eclipse JGit |
Affected:
7.2.0 , < 7.2.1.202505142326-r
(osgi)
Affected: 7.1.0 , < 7.1.1.202505221757-r (osgi) Affected: 7.0.0 , < 7.0.1.202505221510-r (osgi) Affected: 0 , < 5.13.4.202507202350-r (osgi) Affected: 6.0.0 , < 6.10.1.202505221210-r (osgi) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4949",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-21T10:22:48.944398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-21T10:24:58.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://projects.eclipse.org",
"defaultStatus": "unaffected",
"product": "Eclipse JGit",
"repo": "https://github.com/eclipse-jgit/jgit",
"vendor": "Eclipse JGit",
"versions": [
{
"lessThan": "7.2.1.202505142326-r",
"status": "affected",
"version": "7.2.0",
"versionType": "osgi"
},
{
"lessThan": "7.1.1.202505221757-r",
"status": "affected",
"version": "7.1.0",
"versionType": "osgi"
},
{
"lessThan": "7.0.1.202505221510-r",
"status": "affected",
"version": "7.0.0",
"versionType": "osgi"
},
{
"lessThan": "5.13.4.202507202350-r",
"status": "affected",
"version": "0",
"versionType": "osgi"
},
{
"lessThan": "6.10.1.202505221210-r",
"status": "affected",
"version": "6.0.0",
"versionType": "osgi"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "pkg:maven/org.eclipse.jgit/org.eclipse.jgit",
"product": "Eclipse JGit",
"repo": "https://github.com/eclipse-jgit/jgit",
"vendor": "Eclipse JGit",
"versions": [
{
"lessThan": "7.2.1.202505142326-r",
"status": "affected",
"version": "7.2.0",
"versionType": "osgi"
},
{
"lessThan": "7.1.1.202505221757-r",
"status": "affected",
"version": "7.1.0",
"versionType": "osgi"
},
{
"lessThan": "7.0.1.202505221510-r",
"status": "affected",
"version": "7.0.0",
"versionType": "osgi"
},
{
"lessThan": "5.13.4.202507202350-r",
"status": "affected",
"version": "0",
"versionType": "osgi"
},
{
"lessThan": "6.10.1.202505221210-r",
"status": "affected",
"version": "6.0.0",
"versionType": "osgi"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Simon Gerst (intrigus-lgtm) https://intrigus.org"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Eclipse JGit versions 7.2.0.202503040940-r and older, the \u003ccode\u003eManifestParser\u003c/code\u003e class used by the \u003ccode\u003erepo\u003c/code\u003e command and the \u003ccode\u003eAmazonS3\u003c/code\u003e class used to implement the experimental \u003ccode\u003eamazons3\u003c/code\u003e git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues."
}
],
"value": "In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues."
}
],
"impacts": [
{
"capecId": "CAPEC-201",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-201 Serialized Data External Linking"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-827",
"description": "CWE-827 Improper Control of Document Type Definition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-14T06:30:04.660Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1"
},
{
"tags": [
"release-notes"
],
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1"
},
{
"tags": [
"release-notes"
],
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1"
},
{
"tags": [
"release-notes"
],
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1"
},
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"
},
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/64"
},
{
"tags": [
"release-notes"
],
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "XXE vulnerability in Eclipse JGit",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2025-4949",
"datePublished": "2025-05-21T06:47:19.777Z",
"dateReserved": "2025-05-19T07:02:22.381Z",
"dateUpdated": "2025-10-14T06:30:04.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9044 (GCVE-0-2024-9044)
Vulnerability from cvelistv5 – Published: 2024-11-29 07:40 – Updated: 2024-11-29 13:43
VLAI
EPSS
VEX
Title
XML External Entity (XXE) Vulnerability in EasyTax
Summary
A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-29 13:43 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| msg Suisse AG | EasyTax |
Affected:
2023 , ≤ 1.2
(semver)
Affected: 2022 , ≤ 1.3 (semver) Affected: <= 2021 , ≤ * (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9044",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:43:27.733877Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T13:43:41.079Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"product": "EasyTax",
"vendor": "msg Suisse AG",
"versions": [
{
"lessThanOrEqual": "1.2",
"status": "affected",
"version": "2023",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.3",
"status": "affected",
"version": "2022",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "\u003c= 2021",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Kiesel (cyllective AG)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.\u003cp\u003e\u003c/p\u003e"
}
],
"value": "A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS."
}
],
"impacts": [
{
"capecId": "CAPEC-228",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-228 DTD Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-827",
"description": "CWE-827 Improper Control of Document Type Definition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T07:40:08.009Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.ag.ch/de/verwaltung/dfr/steuern/natuerliche-personen/steuererklaerung-easytax"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "XML External Entity (XXE) Vulnerability in EasyTax",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2024-9044",
"datePublished": "2024-11-29T07:40:08.009Z",
"dateReserved": "2024-09-20T12:34:24.469Z",
"dateUpdated": "2024-11-29T13:43:41.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-24GF-PFRX-X3GP
Vulnerability from github – Published: 2026-11-06 12:30 – Updated: 2026-11-06 12:30
VLAI
Details
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
Severity
{
"affected": [],
"aliases": [
"CVE-2026-123312"
],
"database_specific": {
"cwe_ids": [
"CWE-827"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-06T11:17:10Z",
"severity": "LOW"
},
"details": "In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.4 sSRF was possible via annotations.xml files during indexing",
"id": "GHSA-24gf-pfrx-x3gp",
"modified": "2026-11-06T12:30:40Z",
"published": "2026-11-06T12:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123312"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.