Do Not Catch java.lang.Throwable

ID

java.no_catch_throwable

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

CWE:396, reliability

Description

Reports catch blocks that catch Throwable or java.lang.Throwable.

Rationale

Throwable is the root of the Java exception hierarchy. Catching it intercepts both Exception (including unchecked RuntimeException subclasses) and Error (JVM-level failures like OutOfMemoryError). Application code should never swallow Error conditions, and catching Throwable does exactly that.

// Bad — catches OOM, SOE, and all other Errors
try {
    process();
} catch (Throwable t) {
    log.error("something went wrong", t);
}

Remediation

Catch the narrowest exception type you can meaningfully handle:

// Good — specific
try {
    process();
} catch (IOException e) {
    log.error("I/O failure", e);
} catch (RuntimeException e) {
    log.error("unexpected error", e);
}

References