OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.
\nOWASP introduces Mishandling of Exceptional Conditions as a new category for 2025. It maps 24 CWEs and focuses on improper error handling, logical errors and failing open; notable entries include CWE-209, error messages containing sensitive information, and CWE-636, not failing securely.
\nOWASP’s prevention guidance is to catch errors where they occur and handle them meaningfully, keep a global exception handler for anything missed, and, when a transaction is interrupted part way through, roll back every part and start again, which it calls failing closed. It also recommends rate limiting, resource quotas and throttling, strict input validation, and centralized error handling, logging, monitoring and alerting.
\nIts example scenarios include resource exhaustion when exceptions during uploads leave resources locked, database errors that reveal full system details to an attacker, and a multi-step financial transaction that is not rolled back after an interruption.
\nUse this for application code in any language and for the design of integrations and workflows. OWASP recommends handling exceptional conditions the same way across an organization to make review and audit easier.
\nDSE recommends adding exceptional-condition handling to the security requirements and test plan of every custom-software project. Require a single error-handling approach per application, generic error messages to users with detailed logs kept server-side, explicit rollback for each multi-step transaction, and limits on uploads, requests and resource use; include these items in code review and in the contractor’s test report.
\nTest by forcing failures: interrupt a multi-step transaction mid-way, make a database or upstream API unavailable, send malformed and missing parameters, and exhaust upload limits. Confirm that no partial transaction is committed, users see no stack traces or system details, resources are released, and the events reach monitoring.
\nOWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions. Reviewed October 18, 2026.
", "content_text": "OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.\nSource facts\nOWASP introduces Mishandling of Exceptional Conditions as a new category for 2025. It maps 24 CWEs and focuses on improper error handling, logical errors and failing open; notable entries include CWE-209, error messages containing sensitive information, and CWE-636, not failing securely.\nOWASP’s prevention guidance is to catch errors where they occur and handle them meaningfully, keep a global exception handler for anything missed, and, when a transaction is interrupted part way through, roll back every part and start again, which it calls failing closed. It also recommends rate limiting, resource quotas and throttling, strict input validation, and centralized error handling, logging, monitoring and alerting.\nIts example scenarios include resource exhaustion when exceptions during uploads leave resources locked, database errors that reveal full system details to an attacker, and a multi-step financial transaction that is not rolled back after an interruption.\nApplicability\nUse this for application code in any language and for the design of integrations and workflows. OWASP recommends handling exceptional conditions the same way across an organization to make review and audit easier.\nDSE recommendation\nDSE recommends adding exceptional-condition handling to the security requirements and test plan of every custom-software project. Require a single error-handling approach per application, generic error messages to users with detailed logs kept server-side, explicit rollback for each multi-step transaction, and limits on uploads, requests and resource use; include these items in code review and in the contractor’s test report.\nVerification\nTest by forcing failures: interrupt a multi-step transaction mid-way, make a database or upstream API unavailable, send malformed and missing parameters, and exhaust upload limits. Confirm that no partial transaction is committed, users see no stack traces or system details, resources are released, and the events reach monitoring.\nOfficial reference\nOWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions. Reviewed October 18, 2026.", "content_markdown": "OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.\n\n## Source facts\n\n[OWASP](https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/) introduces Mishandling of Exceptional Conditions as a new category for 2025. It maps 24 CWEs and focuses on improper error handling, logical errors and failing open; notable entries include CWE-209, error messages containing sensitive information, and CWE-636, not failing securely.\n\nOWASP’s prevention guidance is to catch errors where they occur and handle them meaningfully, keep a global exception handler for anything missed, and, when a transaction is interrupted part way through, roll back every part and start again, which it calls failing closed. It also recommends rate limiting, resource quotas and throttling, strict input validation, and centralized error handling, logging, monitoring and alerting.\n\nIts example scenarios include resource exhaustion when exceptions during uploads leave resources locked, database errors that reveal full system details to an attacker, and a multi-step financial transaction that is not rolled back after an interruption.\n\n## Applicability\n\nUse this for application code in any language and for the design of integrations and workflows. OWASP recommends handling exceptional conditions the same way across an organization to make review and audit easier.\n\n## DSE recommendation\n\nDSE recommends adding exceptional-condition handling to the security requirements and test plan of every custom-software project. Require a single error-handling approach per application, generic error messages to users with detailed logs kept server-side, explicit rollback for each multi-step transaction, and limits on uploads, requests and resource use; include these items in code review and in the contractor’s test report.\n\n## Verification\n\nTest by forcing failures: interrupt a multi-step transaction mid-way, make a database or upstream API unavailable, send malformed and missing parameters, and exhaust upload limits. Confirm that no partial transaction is committed, users see no stack traces or system details, resources are released, and the events reach monitoring.\n\n## Official reference\n\n[OWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions](https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/", "url": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "OWASP A10:2025: make custom apps fail closed when errors, timeouts and partial transactions occur", "item": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/#article", "identifier": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/", "url": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/", "headline": "OWASP A10:2025: make custom apps fail closed when errors, timeouts and partial transactions occur", "description": "OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch…", "abstract": "OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.", "articleBody": "OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.\nSource facts\nOWASP introduces Mishandling of Exceptional Conditions as a new category for 2025. It maps 24 CWEs and focuses on improper error handling, logical errors and failing open; notable entries include CWE-209, error messages containing sensitive information, and CWE-636, not failing securely.\nOWASP’s prevention guidance is to catch errors where they occur and handle them meaningfully, keep a global exception handler for anything missed, and, when a transaction is interrupted part way through, roll back every part and start again, which it calls failing closed. It also recommends rate limiting, resource quotas and throttling, strict input validation, and centralized error handling, logging, monitoring and alerting.\nIts example scenarios include resource exhaustion when exceptions during uploads leave resources locked, database errors that reveal full system details to an attacker, and a multi-step financial transaction that is not rolled back after an interruption.\nApplicability\nUse this for application code in any language and for the design of integrations and workflows. OWASP recommends handling exceptional conditions the same way across an organization to make review and audit easier.\nDSE recommendation\nDSE recommends adding exceptional-condition handling to the security requirements and test plan of every custom-software project. Require a single error-handling approach per application, generic error messages to users with detailed logs kept server-side, explicit rollback for each multi-step transaction, and limits on uploads, requests and resource use; include these items in code review and in the contractor’s test report.\nVerification\nTest by forcing failures: interrupt a multi-step transaction mid-way, make a database or upstream API unavailable, send malformed and missing parameters, and exhaust upload limits. Confirm that no partial transaction is committed, users see no stack traces or system details, resources are released, and the events reach monitoring.\nOfficial reference\nOWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:18+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "OWASP A10:2025: make custom apps fail closed when errors, timeouts and partial transactions occur" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 332, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions", "url": "https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/" } } ] } }