CWE-484
Weakness AllowedOmitted Break Statement in Switch
Abstraction: Base · Status: Draft
The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Detection methods
White Box
Omission of a break statement might be intentional, in order to support fallthrough. Automated detection methods might therefore be erroneous. Semantic understanding of expected product behavior is required to interpret whether the code is correct.
Black Box
Since this weakness is associated with a code construct, it would be indistinguishable from other errors that produce the same behavior.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
updated Time_of_Introduction
updated Applicable_Platforms, Description, Detection_Factors, Relationships, Other_Notes, Taxonomy_Mappings
updated Applicable_Platforms, Demonstrative_Examples, Description, Detection_Factors, Name, Other_Notes, Potential_Mitigations, Weakness_Ordinalities
updated Common_Consequences, Relationships, Taxonomy_Mappings
updated Common_Consequences, References, Relationships, Taxonomy_Mappings
updated Demonstrative_Examples
updated Relationships, Taxonomy_Mappings
updated Demonstrative_Examples, Relationships
updated Weakness_Ordinalities
updated References, Relationships
updated Relationships
updated Description, Detection_Factors
updated Detection_Factors, Relationships
updated Mapping_Notes
updated Demonstrative_Examples
updated Applicable_Platforms, Relationships
updated Common_Consequences, Demonstrative_Examples, Description, References
4 vulnerabilities reference this CWE, most recent first.
CVE-2026-44075 (GCVE-0-2026-44075)
Vulnerability from cvelistv5 – Published: 2026-05-21 08:14 – Updated: 2026-05-21 12:50- CWE-484 - Omitted Break Statement in Switch
| URL | Tags |
|---|---|
| https://netatalk.io/security/CVE-2026-44075 | vendor-advisory |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-21T12:50:45.834277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-21T12:50:52.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Netatalk",
"vendor": "Netatalk",
"versions": [
{
"lessThanOrEqual": "4.4.2",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"datePublic": "2026-05-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-484",
"description": "Omitted Break Statement in Switch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-21T08:23:44.721Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "Netatalk Security Advisory CVE-2026-44075",
"tags": [
"vendor-advisory"
],
"url": "https://netatalk.io/security/CVE-2026-44075"
}
],
"title": "Missing break in DSI OpenSession"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-44075",
"datePublished": "2026-05-21T08:14:41.523Z",
"dateReserved": "2026-05-05T07:25:20.197Z",
"dateUpdated": "2026-05-21T12:50:52.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-593V-WCQX-HQ2W
Vulnerability from github – Published: 2021-09-07 22:57 – Updated: 2026-11-02 18:34Impact
A security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform. Even though no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags, for example if you defined this dependency:
"parse-server": "git@github.com:parse-community/parse-server.git#4.9.3"
We have since deleted the incorrect version tags, but they may still show up in your personal fork on GitHub or locally. We do not know when these tags have been pushed to the Parse Server repository, but we first became aware of this issue on July 21, 2021. We are not aware of any malicious code or concerns related to privacy, security or legality (e.g. proprietary code). However, it has been reported that some functionality does not work as expected and the introduction of security vulnerabilities cannot be ruled out.
You may be also affected if you used the Bitnami image for Parse Server. Bitnami picked up the incorrect version tag 4.9.3 and published a new Bitnami image for Parse Server.
If you are using any of the affected versions, we urgently recommend to upgrade to version 4.10.0.
These are the incorrect tags:
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-beta4
4.0.0-beta5
4.0.0-beta6
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.3
4.0.4
4.0.6
4.0.7
4.0.8
4.0.9
4.6.0
4.6.0-beta
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.2
4.9.3
Patches
Upgrade to version 4.10.0.
Workarounds
Downgrade to version 4.5.2.
References
n/a
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.5.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-484",
"CWE-494"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-03T21:34:00Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nA security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform. Even though no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags, for example if you defined this dependency: \n```js\n\"parse-server\": \"git@github.com:parse-community/parse-server.git#4.9.3\"\n```\n\nWe have since deleted the incorrect version tags, but they may still show up in your personal fork on GitHub or locally. We do not know when these tags have been pushed to the Parse Server repository, but we first became aware of this issue on July 21, 2021. We are not aware of any malicious code or concerns related to privacy, security or legality (e.g. proprietary code). However, it has been reported that some functionality does not work as expected and the introduction of security vulnerabilities cannot be ruled out.\n\nYou may be also affected if you used the Bitnami image for Parse Server. Bitnami picked up the incorrect version tag `4.9.3` and published a new Bitnami image for Parse Server. \n \n**If you are using any of the affected versions, we urgently recommend to upgrade to version `4.10.0`.**\n\n\nThese are the incorrect tags:\n```\n4.0.0-beta1\n4.0.0-beta2\n4.0.0-beta3\n4.0.0-beta4\n4.0.0-beta5\n4.0.0-beta6\n4.0.10\n4.0.11\n4.0.12\n4.0.13\n4.0.14\n4.0.3\n4.0.4\n4.0.6\n4.0.7\n4.0.8\n4.0.9\n4.6.0\n4.6.0-beta\n4.7.0\n4.8.0\n4.8.1\n4.8.2\n4.8.3\n4.8.4\n4.8.5\n4.9.0\n4.9.1\n4.9.2\n4.9.3\n```\n\n### Patches\nUpgrade to version `4.10.0`.\n\n### Workarounds\nDowngrade to version `4.5.2`.\n\n### References\nn/a",
"id": "GHSA-593v-wcqx-hq2w",
"modified": "2026-11-02T18:34:07Z",
"published": "2021-09-07T22:57:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-593v-wcqx-hq2w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47986"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47987"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/parse-server-arbitrary-code-execution-via-malicious-version-tags"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/parse-server-unreviewed-code-execution-via-malicious-version-tags"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Incorrect version tags linked to external repository"
}
GHSA-7MXX-3CGM-XXV3
Vulnerability from github – Published: 2025-03-24 16:31 – Updated: 2025-03-24 18:41Summary
A security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in this clause: https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56
https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57
PoC
Create a graphql endpoint with a security after resolver.
Impact
As this fallsback to security, the impact is there only when there's only a security after resolver and none inside security. The test at https://github.com/api-platform/core/pull/6444 is probably broken.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "api-platform/core"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.8"
},
{
"fixed": "3.3.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-23204"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-484"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-24T16:31:08Z",
"nvd_published_at": "2025-03-24T16:15:56Z",
"severity": "MODERATE"
},
"details": "### Summary\nA security check that gets called after GraphQl resolvers is always replaced by another one as there\u0027s no break in this clause: https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56\n\nhttps://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57 \n\n### PoC\n\nCreate a graphql endpoint with a security after resolver.\n\n### Impact\n\nAs this fallsback to `security`, the impact is there only when there\u0027s only a security after resolver and none inside security. The test at https://github.com/api-platform/core/pull/6444 is probably broken.",
"id": "GHSA-7mxx-3cgm-xxv3",
"modified": "2025-03-24T18:41:25Z",
"published": "2025-03-24T16:31:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23204"
},
{
"type": "WEB",
"url": "https://github.com/api-platform/core/pull/6444"
},
{
"type": "WEB",
"url": "https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56"
},
{
"type": "WEB",
"url": "https://github.com/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620"
},
{
"type": "PACKAGE",
"url": "https://github.com/api-platform/core"
},
{
"type": "WEB",
"url": "https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "API Platform Core does not call GraphQl securityAfterResolver"
}
GHSA-8QF9-M7WH-563J
Vulnerability from github – Published: 2026-05-21 09:32 – Updated: 2026-05-21 09:32A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.
{
"affected": [],
"aliases": [
"CVE-2026-44075"
],
"database_specific": {
"cwe_ids": [
"CWE-484"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-21T09:16:29Z",
"severity": "LOW"
},
"details": "A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.",
"id": "GHSA-8qf9-m7wh-563j",
"modified": "2026-05-21T09:32:12Z",
"published": "2026-05-21T09:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44075"
},
{
"type": "WEB",
"url": "https://netatalk.io/security/CVE-2026-44075"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Omitting a break statement so that one may fall through is often indistinguishable from an error, and therefore should be avoided. If you need to use fall-through capabilities, make sure that you have clearly documented this within the switch statement, and ensure that you have examined all the logical possibilities.
Mitigation
The functionality of omitting a break statement could be clarified with an if statement. This method is much safer.
No CAPEC attack patterns related to this CWE.