CWE-187: Partial String Comparison
Filter
The product performs a string comparison that only examines a portion of the string before determining whether there is a match.
What the weakness is: CWE-187 at MITRE. All weaknesses
Ask an AI about CWE-187
Show the prompt
Explain CWE-187: Partial String Comparison and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/187.html and https://cve.bz/cve/cwe/187?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2026-115646EPSS 0.4%
Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50…
- 6.3CVE-2026-125371EPSS 0.3%
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record fo…
- 8.2CVE-2026-112266EPSS 0.4%
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with…
- 5.9CVE-2026-94576EPSS 0.4%
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass …
- 6.5CVE-2026-101914EPSS 0.3%
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison…
- 5.5CVE-2026-81479EPSS 0.2%
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
- 7.5CVE-2026-87853EPSS 0.3%
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an…
- 6.3CVE-2026-84376EPSS 0.7%
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request …
- 6.5CVE-2026-62750EPSS 0.7%
Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network.
- 5.5CVE-2026-14687EPSS 0.5%
A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead …
- 3.8CVE-2026-45692EPSS 0.2%
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one confi…
- 6.9CVE-2026-55602EPSS 0.4%
http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses una…
- 7.5CVE-2026-44837EPSS 0.4%
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whe…
- 8.8CVE-2026-35031EPSS 0.8%
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversa…
- 7.5CVE-2026-34785EPSS 0.4%
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes suc…
- 1.8CVE-2026-30874EPSS 0.3%
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH var…
- 6.3CVE-2025-23384EPSS 0.3%
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions …
- 9.9CVE-2024-41110EPSS 16%
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under sp…
- 9.8CVE-2024-39742EPSS 0.8%
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.
- 9.8CVE-2022-31802EPSS 1.3%
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matche…