# OWASP A10:2025: make custom apps fail closed when errors, timeouts and partial transactions occur

> OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.

- Canonical URL: https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-18T21:00:18+00:00
- Modified: 2026-10-18T22:22:06+00:00
- Last reviewed by DSE: 2026-10-18
- Resource type: Guide
- DSE priority: Advisory
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.

## Potentially affected

Custom web applications, APIs, payment or ordering workflows, integrations and background jobs, especially multi-step transactions and code that calls databases, files or external services.

## DSE recommendation

DSE recommends adding exceptional-condition handling to the security requirements and test plan of every custom-software project.

## Article

OWASP’s 2025 Top 10 adds Mishandling of Exceptional Conditions, covering poor error handling, logic errors and failing open. Its guidance is to catch errors where they occur, roll back interrupted transactions, limit resources and centralize handling.

## Source facts

[OWASP](https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/) introduces Mishandling of Exceptional Conditions as a new category for 2025. It maps 24 CWEs and focuses on improper error handling, logical errors and failing open; notable entries include CWE-209, error messages containing sensitive information, and CWE-636, not failing securely.

OWASP’s prevention guidance is to catch errors where they occur and handle them meaningfully, keep a global exception handler for anything missed, and, when a transaction is interrupted part way through, roll back every part and start again, which it calls failing closed. It also recommends rate limiting, resource quotas and throttling, strict input validation, and centralized error handling, logging, monitoring and alerting.

Its example scenarios include resource exhaustion when exceptions during uploads leave resources locked, database errors that reveal full system details to an attacker, and a multi-step financial transaction that is not rolled back after an interruption.

## Applicability

Use this for application code in any language and for the design of integrations and workflows. OWASP recommends handling exceptional conditions the same way across an organization to make review and audit easier.

## DSE recommendation

DSE recommends adding exceptional-condition handling to the security requirements and test plan of every custom-software project. Require a single error-handling approach per application, generic error messages to users with detailed logs kept server-side, explicit rollback for each multi-step transaction, and limits on uploads, requests and resource use; include these items in code review and in the contractor’s test report.

## Verification

Test by forcing failures: interrupt a multi-step transaction mid-way, make a database or upstream API unavailable, send malformed and missing parameters, and exhaust upload limits. Confirm that no partial transaction is committed, users see no stack traces or system details, resources are released, and the events reach monitoring.

## Official reference

[OWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions](https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/). Reviewed October 18, 2026.

## Primary reference

- Name: OWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions
- Authority: top10.owasp.org
- URL: https://top10.owasp.org/2025/A10_2025-Mishandling_of_Exceptional_Conditions/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “OWASP A10:2025: make custom apps fail closed when errors, timeouts and partial transactions occur,” DSE Security, https://update.dsesecurity.com/updates/owasp-top-10-2025-a10-mishandling-exceptional-conditions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.