CWE-1254— Incorrect Comparison Logic Granularity
The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.— MITRE CWE catalog
8 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-1254page 1 of 1
- CVE-2015-8857CRITICALCVSS 9.8EG 9.82017-01-23
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by lev…
- CVE-2016-6582CRITICALCVSS 9.1EG 9.12017-01-23
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
- CVE-2026-34572HIGHCVSS 8.8EG 8.82026-04-01
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …
- CVE-2026-34570HIGHCVSS 8.8EG 8.82026-04-01
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …
- CVE-2026-28929HIGHCVSS 7.5EG 7.52026-05-11
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.
- CVE-2013-10031HIGHCVSS 7.5EG 7.52025-12-09
Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks
- CVE-2022-39308MEDIUMCVSS 6.5EG 6.52022-10-14
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 (inclusive) are subject to a timing attack in validatio…
- CVE-2026-27007LOWCVSS 3.3EG 3.32026-02-20
OpenClaw is a personal AI assistant. Prior to version 2026.2.15, `normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arra…
Map vulnerabilities like CWE-1254 to your infrastructure
EchelonGraph correlates every CVE — across CWE-1254 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →