CWE-Specific Remediation Guidance
This directory contains 187 CWE-specific remediation guides with OWASP-aligned recommendations for fixing security vulnerabilities discovered by static and dynamic analysis tools.
Coverage
- 187 CWEs: Remediation guidance organized by CWE
- 77 CWEs: Detailed language-specific examples
- 110 CWEs: Generic, language-agnostic remediation guidance
- 305 language-specific pages: Examples across 10 languages
Browse CWE guidance:
- CWE Guidance - 187 CWEs with remediation guidance for developers working from static analysis, dynamic analysis, penetration test, or code review findings.
Guidance Types
Generic Guidance (110 CWEs):
- Language-agnostic remediation strategies
- Common vulnerable patterns and secure patterns
- Risk, remediation steps, and additional resources
Language-Specific Guidance (77 CWEs):
- Detailed code examples for implementation-heavy vulnerabilities
- Framework-specific guidance for common stacks
- Considerations, testing and migration notes where the CWE calls for them
Generic pages describe the fix in language-neutral terms; the language pages are where the concrete APIs, worked examples and the reasoning behind them live.
Generic Guidance Content
Each generic CWE guidance file includes:
- Overview: What the vulnerability is
- Risk: Severity and potential impact
- OWASP Classification: Mapping to OWASP Top 10 2025
- Primary Remediation: Core fix strategy
- Secure Coding Practices: Input validation, output encoding, defense-in-depth
- Language-Specific Guidance: High-level pointers for major languages
- Additional Resources: Links to CWE, OWASP, and supporting documentation
- Next Steps: Concrete action items
Language-Specific Guidance Content
Detailed language-specific guides include:
- Vulnerable Patterns: Code examples showing the vulnerability
- Secure Patterns: Code examples showing the fix
- Framework-Specific Guidance: Spring, ASP.NET, Django, Express, etc.
- Input Validation Patterns: Reusable validation code
- Common Pitfalls: Fixes that look plausible but leave the weakness
- Considerations: Whether the finding is material here, and what changes the answer
- Migration Considerations: Step-by-step refactoring guide
- Testing: What to assert where a re-scan cannot confirm the fix
OWASP Alignment
All guidance aligns with OWASP recommendations:
- OWASP Top 10 2025 classification included
- OWASP Cheat Sheet Series patterns referenced
- OWASP ESAPI principles followed
- Defense in Depth emphasized throughout
- Secure by Default approach recommended
OWASP Top 10:2025 (Web Application Security)
The OWASP Classification field on each CWE page maps to this list - OWASP's general web-application risk categories.
| Category | Name |
|---|---|
| A01:2025 | Broken Access Control |
| A02:2025 | Security Misconfiguration |
| A03:2025 | Software Supply Chain Failures |
| A04:2025 | Cryptographic Failures |
| A05:2025 | Injection |
| A06:2025 | Insecure Design |
| A07:2025 | Authentication Failures |
| A08:2025 | Software or Data Integrity Failures |
| A09:2025 | Security Logging & Alerting Failures |
| A10:2025 | Mishandling of Exceptional Conditions |
Source: OWASP Top 10:2025
OWASP Top 10 for LLM Applications (2025)
A separate OWASP list covering generative-AI and LLM-specific risks, referenced here for context only. No CWE mapping currently exists.
| Category | Name |
|---|---|
| LLM01:2025 | Prompt Injection |
| LLM02:2025 | Sensitive Information Disclosure |
| LLM03:2025 | Supply Chain |
| LLM04:2025 | Data and Model Poisoning |
| LLM05:2025 | Improper Output Handling |
| LLM06:2025 | Excessive Agency |
| LLM07:2025 | System Prompt Leakage |
| LLM08:2025 | Vector and Embedding Weaknesses |
| LLM09:2025 | Misinformation |
| LLM10:2025 | Unbounded Consumption |
Source: OWASP Top 10 for LLM Applications (2025)
Language Coverage
Language-Specific Guidance Available:
- Java - 56 CWE guides with Spring, Jakarta EE, and JDBC examples
- Python - 56 CWE guides with Django, Flask, and standard-library patterns
- JavaScript - 51 CWE guides with Node.js, Express, browser, and framework examples
- C# - 45 CWE guides with .NET Framework, .NET, and ASP.NET examples
- Go - 28 CWE guides with standard-library and framework patterns
- PHP - 29 CWE guides with core PHP and framework patterns
- C - 23 CWE guides with low-level, memory-safety examples
- C++ - 12 CWE guides with RAII and standard-library-based examples
- Perl - 2 CWE guides with selected vulnerability patterns
- Ruby - selected framework-specific examples
Generic Guidance applies to all languages with framework-agnostic remediation strategies
Usage Statistics
- 187 CWEs with comprehensive remediation guidance
- 77 CWEs with language-specific examples
- 110 CWEs with generic guidance only
- 305 language-specific guidance pages
- 10 languages represented across detailed examples
- OWASP Top 10 2025 coverage included