CWE-1254 6 CVEs MITRE definition ↗

CWE-1254: Incorrect Comparison Logic Granularity

Overview

CWE-1254 (Incorrect Comparison Logic Granularity) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language Not Language-Specific Undetermined
operating_system Not OS-Specific Undetermined
architecture Not Architecture-Specific Undetermined
technology Not Technology-Specific Undetermined

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2026-28929 2026-05-11 A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display r…
CVE-2026-34572 2026-04-01 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immedi…
CVE-2026-34570 2026-04-01 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immedi…
CVE-2026-27007 2026-02-20 OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made ord…
CVE-2013-10031 2025-12-09 Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks
CVE-2022-39308 2022-10-14 GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 (inclusive) are …

Content submission

Name
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Organization
Intel Corporation
Date
2020-02-12
Version
4.1

Content modifications

Date Name Version Importance Comment
2020-08-20 CWE Content Team 4.2 updated Relationships
2021-07-20 CWE Content Team 4.5 updated Related_Attack_Patterns
2022-10-13 CWE Content Team 4.9 updated Demonstrative_Examples
2023-04-27 CWE Content Team 4.11 updated Observed_Examples, Relationships
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2023-10-26 CWE Content Team 4.13 updated Demonstrative_Examples, Observed_Examples
2024-11-19 CWE Content Team 4.16 updated Demonstrative_Examples, Maintenance_Notes
2025-12-11 CWE Content Team 4.19 updated Weakness_Ordinalities

Contributions

Type Name Date Comment
Feedback Anders Nordstrom 2024-01-09 reported problems with the Verilog demonstrative example, leading to its removal from this entry
cvelogic Threat Intelligence