Last generated: 2026-05-20 17:50:46
WARNING: this file was automatically generated. Do not edit.
| ID | Name |
|---|---|
| SUB.UNCLEAR | Unclear weakness |
| SUB.ATTACK | Too attack-focused |
| SUB.MITIGATION | Too mitigation-focused |
| SUB.OVERLAP | Duplicate/Overlap |
| SUB.ABS.SUBTREE | Potential subtree issue/gap |
| SUB.ABS.LOWLEVEL | Low level of abstraction |
| SUB.ABS.MULTWEAK | Multiple weaknesses |
| SUB.RELS | Unclear relationships |
| SUB.MISSDET | Missing details |
| SUB.IPR | IP Rights Concerns |
| SUB.RELREFS | No relevant references |
| SUB.GRAMMAR | Grammar/Spelling issues |
| SUB.NOINIT | Detailed Submission with No Initial Review |
| SUB.ACTION | Unable to determine action |
| SUB.ACTCHANGE | Change in action for submission |
| SUB.MISC | Miscellaneous/other problem |
| SUB.COORD | Requires extensive coordination |
| SUB.NEWTECH | New/Emerging Technology |
| SUB.WITHDRAWN | Withdrawn Submission |
Block Phase - Init-Consultation
The submission's name and/or description does not clearly identify a weakness, or it is written in a way that is vague and could cause the submission to be incorrectly mapped to.
A submission cannot progress past the consultation phase until SUB.UNCLEAR is addressed.
Block Phase - Init-Consultation
The submission's name and/or description emphasizes the attack, not the weakness. Either the submission's weakness is not well-understood, or it is better described as an attack pattern, which may be suitable for inclusion in CAPEC.
An initial submission cannot progress to later phases unless it also includes a clear weakness (i.e., is not subject to SUB.UNCLEAR).
Block Phase - Init-Consultation
The submission's name and/or description emphasizes missing or incorrect mitigation without clarifying the weakness.
The submission cannot progress to later phases unless it also includes a clear weakness (i.e., is not subject to SUB.UNCLEAR).
Block Phase - Init-Consultation
The submission identifies a weakness, but it is a duplicate of (or partially overlaps) existing weaknesses or other submissions, indicating problems with the submission or associated CWE entries.
The submission cannot progress to later phases until (1) the duplicate/overlap is understood and (2) it is clear how to resolve this duplicate/overlap.
Block Phase - Internal-Update
The submission might identify an issue for which there could be a broader gap or organizational challenge that requires analysis of CWE subtree relationships under Research View 1000, in ways that extend beyond creation of a parent at the next-highest level of abstraction.
The submission cannot progress past the consultation phase (whether initial or detailed) unless it is at an acceptable level of abstraction, and the subtree issue(s) can be resolved or addressed independently.
Block Phase - Init-Consultation
The submission identifies an issue, but its abstraction might be too low-level to merit its own CWE entry. If it is focused on a particular technology, framework, protocol, or function, then it might not be unique enough to get its own CWE ID. This might lead to modification of an existing entry to include the additional details, or creation of a higher-level entry for which the submission is one example. (Note: some older CWE entries have this problem and would not be published today, generally because they were too specific to a particular language.)
The submission will be allowed to progress to later phases once the more-general concept is appropriately identified and described. The original, lower-level submission will serve as a primary example of the more general concept.
Block Phase - Init-Consultation
The submission describes or suggests multiple independent weaknesses that each might deserve a separate CWE ID.
The submission cannot progress past the consultation phase until the number of relevant weaknesses is identified. If there are multiple weaknesses, separate names and descriptions are needed.
Block Phase - Internal-Update
The submission suggests some relationships, but the name/description is not explained in a way in which the relationship is relevant; or, the weakness is apparent, but it is not clear what the best parent/child relationship(s) would be.
The submission cannot progress to the next phase if SUB.UNCLEAR is present. It can progress to other phases if the CWE Team agrees that the potential relationships may require closer investigation. The submission cannot progress to the Publication stage until clear relationships and direct parents are identified. The CWE Team may decide to use high-level relationships (e.g., to Pillars) if deeper problems such as SUB.ABS.SUBTREE exist and cannot be quickly resolved.
Block Phase - any
The submission is missing some requested or required details for elements other than name and description.
The submission cannot progress to later phases if it does not have all required elements.
Block Phase - any
The submission might have concerns related to intellectual property rights, e.g., by citing or deriving content from sources that are subject to significant restrictions, or if the content is copied verbatim from a source without attribution (i.e., plagiarism).
The submission cannot progress to later phases until it is clear that there are no IP concerns. Note: as of June 2024, the CWE Team has not decided how to handle information derived from AI/ML systems that use sources that did not explicitly authorize usage.
Block Phase - Internal-Update
The submission does not provide relevant references that explain the weakness, or the relevance is not easily found.
The submission is not likely to progress to later phases if there are no applicable, easily-accessible references. The submitter could resolve by providing additional details such as a section name and quote from the reference. If no suitable references can be found, the CWE Team may decide to make an exception.
Block Phase - Internal-Update
The submission has multiple occurrences of errors with grammar, spelling, etc. that must be fixed before the Publication stage.
The submission will not be allowed to progress to later phases if the grammar or spelling problems are so significant that they are likely to cause difficulty for readers to understand the weakness. If the issues are minor, then the submission could progress. However, no submission can move to the Publication stage without grammar and spelling checks. American English is used for spelling.
Block Phase - Init-Consultation, Internal-Update
A detailed submission was provided, but it did not go through the Initial Review / Initial Consultation phases (Stage 1) and has significant problems that should have been resolved in that phase (e.g., SUB.UNCLEAR). This primarily applies to situations when external requesters provided a "Full Submission" form (Internal-Update phase) in 2021 and 2022, before the CWE Team launched the external submission web server and formalized the CDR process.
The submission must be treated as part of the Initial-Review/Initial-Consultation phase, and the detailed submission will not be evaluated until Stage 1 is complete.
Block Phase - Init-Consultation
It is not clear what action to perform based on the submission, e.g., create new entry, update existing entry, etc.
The submission cannot progress to the Internal-Update stage until the relevant actions(s) are identified.
Block Phase - Init-Consultation
The submission's action needs to change, e.g., from "New Entry" to "Modification," or vice versa. This potentially requires changes to the kinds of information that will need to be provided.
The submission cannot progress to Stage 3 (Content-Generation) until the informational needs are addressed.
Block Phase - any
The submission has some other problem that is not covered elsewhere.
This will depend on the nature of the problem.
Block Phase - Init-Consultation, Det-Consultation
The submission will require or is currently undergoing close coordination, discussion, and debate between multiple parties with different perspectives and opinions. The communication could be taking place in CDR itself, or outside of CDR. As a result, it might take longer to move the submission to later phases, although the submission is expected to be more robust and well-defined as a result of this coordination.
The submission cannot progress past the Init-Consultation or Det-Consultation phases until sufficient consensus has been reached, or if the CWE Team decides to move the submission to the next phase.
Block Phase - Init-Consultation, Det-Consultation
The submission is related to a new or emerging technology that is not well-understood from a weakness perspective, which can cause real or perceived gaps in CWE that require extra effort and time to analyze. Typically, for new/emerging technologies, early vulnerability discovery and research does not focus on root cause analysis (i.e., weakness identification). Instead, the focus is on other areas such as attacks and exploitation methods, technical impacts, threats, mitigations, or other concerns. As a result, industry understanding can be limited, effectively requiring research or focused efforts by SMEs to understand the underlying weaknesses. Rapidly-changing, diverse terminology and technology can further complicate understanding. Finally, there might not be enough real-world examples with sufficient details from which weakness patterns may be discovered. For this reason, it can be difficult to determine whether CWE entries already cover the topics of concern, and which gaps (if any) exist. As of May 2024, some new or emerging technologies include AI/ML, cryptocurrency/blockchain, post-quantum cryptography, and large-scale architectures with many components that have different trust boundaries. In previous years, new/emerging domains for CWE included hardware, cloud, and ICS/OT.
The submission cannot progress past the Init-Consultation or Det-Consultation phases until sufficient attempts have been made to understand the weaknesses commonly seen in new or emerging technologies, or if the CWE Team decides to move the submission to the next phase. Analysis could include analyzing well-known attacks to understand the weaknesses that enable the attacks to succeed; analysis of mitigations to understand how the underlying weaknesses are perceived; and/or other methods. Such analysis might require consultation with a variety of Subject Matter Experts (SMEs).
Block Phase - any
The original submitter has withdrawn from active participation in further development of the submission, or the submitter has not responded to multiple requests for feedback. The submitter's withdrawal may be due to reasons such as lack of time, changing priorities, technical challenges in resolving issues with the submission, email address or other contact information that is no longer valid, etc.
The CWE Team must decide what to do with the submission in its current state, such as: (1) decline or close the submission outright; or (2) continue to work independently with the submission.
For submissions that are ultimately integrated into CWE, the CWE Team will decide which credits to provide - based on the public information in the submission - or credit an "anonymous contributor."