cve.bz

CWE-1254: Incorrect Comparison Logic Granularity

Filter

The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.

What the weakness is: CWE-1254 at MITRE. All weaknesses

Related attack patterns (CAPEC): 1
  • CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-1254, as MITRE names them. Credits.

Ask an AI about CWE-1254

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1254: Incorrect Comparison Logic Granularity and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1254.html and https://cve.bz/cve/cwe/1254?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-28929EPSS 0.4%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.

  2. 8.8CVE-2026-34572EPSS 0.5%

    CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …

  3. 8.8CVE-2026-34570EPSS 0.5%

    CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …

  4. 4.8CVE-2026-27007EPSS 0.2%

    OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arra…

  5. 7.5CVE-2013-10031EPSS 0.3%

    Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks

  6. 5.9CVE-2022-39308EPSS 0.9%

    GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 (inclusive) are subject to a timing attack in validatio…