Weakness · Medium
CWE-365: DEPRECATED: Race Condition in Switch
What it is
This entry has been deprecated. There are no documented cases in which a switch's control expression is evaluated more than once.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Not stated
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
It is likely that this entry was initially created based on a misinterpretation of the original source material. The original source intended to explain how switches could be unpredictable when using threads, if the control expressions used data or variables that could change between execution of different threads. That weakness is already covered by CWE-367. Despite the ambiguity in the documentation for some languages and compilers, in practice, they all evaluate the switch control expression only once. If future languages state that the code explicitly evaluates the control expression more than once, then this would not be a weakness, but the language performing as designed.
How to prevent it
MITRE lists no specific mitigation for this weakness. Treat it like its parent weaknesses below: validate input, keep the design simple and review the code where it could appear.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.