CWE-396 (对通用异常声明Catch语句) — Vulnerability Class 2

CWE-396 represents a coding weakness where developers catch overly broad exception types, such as the generic Exception class, rather than specific error types. This practice obscures critical error details, making it difficult to distinguish between expected runtime issues and unexpected security-related failures. Attackers typically exploit this by triggering specific vulnerabilities that generate exceptions, which are then silently swallowed or mishandled by the generic catch block. This lack of granular error handling can lead to information disclosure, denial of service, or unintended state changes. To avoid this weakness, developers should implement precise exception handling by catching only the specific exceptions they intend to manage. This approach ensures that unexpected errors propagate correctly, allowing for proper logging, debugging, and secure failure responses, thereby maintaining the integrity and stability of the application.