CWE-372: Incomplete Internal State Distinction

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

A kind of CWE-664 Improper Control of a Resource Through its Lifetime.

From the CWE List. © The MITRE Corporation.

Newest

• bytecodealliance wasmtime Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield CVE-2026-119140 Fix available 5.9 MediumOctober 14, 2026
• elated-themes frappe Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts CVE-2023-54406 6.9 MediumOctober 12, 2026
• wolfssh wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion CVE-2026-84897 Fix available 6.9 MediumOctober 7, 2026
• openclaw OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding CVE-2026-41300 Fix available 6.9 MediumApril 3, 2026
• openclaw OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration CVE-2026-41340 Fix available 6.3 MediumApril 3, 2026
• openclaw OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling CVE-2026-41388 Fix available 6.3 MediumApril 3, 2026
• ptrd kwik The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connectio… CVE-2024-22590 9.1 CriticalMay 28, 2024
• github.com/cosmos/cosmos-sdk Go ASA-2024-005: Potential slashing evasion during re-delegation GHSA-86h5-xcpx-cfqc Fix available No scoreFebruary 27, 2024
• ntpsec Incomplete Internal State Distinction in ntpsec CVE-2023-4012 Fix available 7.5 HighAugust 4, 2023
• juniper junos, juniper networks junos os +1 more Junos OS: SRX 4600 and SRX 5000 Series: The receipt of specific genuine packets by SRXes configured for L2 transparency will cause a DoS CVE-2023-36834 6.5 MediumJuly 14, 2023
• dmtf libspdm DMTF-2023-0001: SPDM mutual authentication bypass CVE-2023-31127 9.1 CriticalMay 8, 2023
• kubernetes Validating Admission Webhook does not observe some previous fields CVE-2021-25735 Public exploitFix available 6.5 MediumMay 28, 2021
• eclipse californium, the eclipse foundation eclipse californium +1 more In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS... CVE-2020-27222 7.5 HighFebruary 3, 2021