CWEweakness

CWE-696 Incorrect Behavior Order

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Common consequences

• Integrity: Alter Execution Logic

Observed examples

• CVE-2019-9805: Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption. • CVE-2007-5191: file-system management programs call the setuid and setgid functions in the wrong order and do not check the return values, allowing attackers to gain unintended privileges • CVE-2007-1588: C++ web server program calls Process::setuid before calling Process::setgid, preventing it from dropping privileges, potentially allowing CGI programs to be called with higher privileges than intended • CVE-2022-37734: Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)

Related

Attack pattern · CAPEC (1)

  • CAPEC-463 Padding Oracle Crypto Attack attack pattern

Observed example · CVE (4)

  • CVE-2022-37734 graphql-java before19.0 is vulnerable to Denial of Service. vulnerability
  • CVE-2019-9805 A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential… vulnerability
  • CVE-2007-5191 mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return… vulnerability
  • CVE-2007-1588 server.cpp in MyServer 0.8.5 calls Process::setuid before calling Process::setgid and thus does not properly drop privileges, which might… vulnerability

Child of · CWE (1)

  • CWE-691 Insufficient Control Flow Management weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-463 Padding Oracle Crypto Attack attack pattern

Referenced by CVE · weakness (53)

  • CVE-2026-65219 A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish… vulnerability
  • CVE-2026-114145 GitPython is a python library used to interact with Git repositories. vulnerability
  • CVE-2026-110450 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store… vulnerability
  • CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in… vulnerability
  • CVE-2026-109162 Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder… vulnerability
  • CVE-2026-26287 External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. vulnerability
  • CVE-2026-105745 Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. vulnerability
  • CVE-2026-103353 Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This… vulnerability
  • CVE-2026-103012 Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead… vulnerability
  • CVE-2026-93330 Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to… vulnerability
  • CVE-2026-93304 A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. vulnerability
  • CVE-2026-73446 On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted… vulnerability
  • CVE-2026-59305 Partition interceptor may be improperly added while sending message. vulnerability
  • CVE-2026-68930 Russh is a Rust SSH client & server library. vulnerability
  • CVE-2026-44108 Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. vulnerability
  • CVE-2026-65100 Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure… vulnerability
  • CVE-2026-67217 cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. vulnerability
  • CVE-2026-14169 Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites… vulnerability
  • CVE-2026-56355 GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization. vulnerability
  • CVE-2026-49317 Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an… vulnerability
  • CVE-2026-49318 Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an… vulnerability
  • CVE-2026-44919 In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the… vulnerability
  • CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. vulnerability
  • CVE-2026-44600 Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. vulnerability
  • CVE-2026-43002 An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. vulnerability
  • CVE-2026-40583 UltraDAG is a minimal DAG-BFT blockchain in Rust. vulnerability
  • CVE-2026-41254 Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the… vulnerability
  • CVE-2026-35652 OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted… vulnerability
  • CVE-2026-40223 In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running. vulnerability
  • CVE-2026-35627 OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and… vulnerability
Show all 53 ›

Referenced by CWE · child of (7)

  • CWE-1190 DMA Device Enabled Too Early in Boot Phase weakness
  • CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control weakness
  • CWE-1279 Cryptographic Operations are Run Before Supporting Units are Ready weakness
  • CWE-1280 Access Control Check Implemented After Asset is Accessed weakness
  • CWE-179 Incorrect Behavior Order: Early Validation weakness
  • CWE-408 Incorrect Behavior Order: Early Amplification weakness
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization weakness