CWEweakness

CWE-697 Incorrect Comparison

Official page ↗
Abstraction
Pillar
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product compares two entities in a security-relevant context, but the comparison is incorrect.

Common consequences

• Other: Varies by Context — When the comparison is incorrect, it may lead to resultant weaknesses.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2021-3116: Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390) • CVE-2020-15811: Chain: Proxy uses a substring search instead of parsing the Transfer-Encoding header (CWE-697), allowing request splitting (CWE-113) and cache poisoning • CVE-2016-10003: Proxy performs incorrect comparison of request headers, leading to infoleak

Related

Attack pattern · CAPEC (29)

  • CAPEC-10 Buffer Overflow via Environment Variables attack pattern
  • CAPEC-120 Double Encoding attack pattern
  • CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
  • CAPEC-15 Command Delimiters attack pattern
  • CAPEC-182 Flash Injection attack pattern
  • CAPEC-24 Filter Failure through Buffer Overflow attack pattern
  • CAPEC-267 Leverage Alternate Encoding attack pattern
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters attack pattern
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads attack pattern
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers attack pattern
  • CAPEC-44 Overflow Binary Resource File attack pattern
  • CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
  • CAPEC-46 Overflow Variables and Tags attack pattern
  • CAPEC-47 Buffer Overflow via Parameter Expansion attack pattern
  • CAPEC-52 Embedding NULL Bytes attack pattern
  • CAPEC-53 Postfix, Null Terminate, and Backslash attack pattern
  • CAPEC-6 Argument Injection attack pattern
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic attack pattern
  • CAPEC-67 String Format Overflow in syslog() attack pattern
  • CAPEC-7 Blind SQL Injection attack pattern
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic attack pattern
  • CAPEC-73 User-Controlled Filename attack pattern
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding attack pattern
  • CAPEC-79 Using Slashes in Alternate Encoding attack pattern
  • CAPEC-8 Buffer Overflow in an API Call attack pattern
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic attack pattern
  • CAPEC-88 OS Command Injection attack pattern
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities attack pattern
  • CAPEC-92 Forced Integer Overflow attack pattern

Observed example · CVE (3)

  • CVE-2021-3116 before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data… vulnerability
  • CVE-2020-15811 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. vulnerability
  • CVE-2016-10003 Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed… vulnerability

Referenced by CAPEC · weakness (29)

  • CAPEC-10 Buffer Overflow via Environment Variables attack pattern
  • CAPEC-120 Double Encoding attack pattern
  • CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
  • CAPEC-15 Command Delimiters attack pattern
  • CAPEC-182 Flash Injection attack pattern
  • CAPEC-24 Filter Failure through Buffer Overflow attack pattern
  • CAPEC-267 Leverage Alternate Encoding attack pattern
  • CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters attack pattern
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads attack pattern
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers attack pattern
  • CAPEC-44 Overflow Binary Resource File attack pattern
  • CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
  • CAPEC-46 Overflow Variables and Tags attack pattern
  • CAPEC-47 Buffer Overflow via Parameter Expansion attack pattern
  • CAPEC-52 Embedding NULL Bytes attack pattern
  • CAPEC-53 Postfix, Null Terminate, and Backslash attack pattern
  • CAPEC-6 Argument Injection attack pattern
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic attack pattern
  • CAPEC-67 String Format Overflow in syslog() attack pattern
  • CAPEC-7 Blind SQL Injection attack pattern
  • CAPEC-71 Using Unicode Encoding to Bypass Validation Logic attack pattern
  • CAPEC-73 User-Controlled Filename attack pattern
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding attack pattern
  • CAPEC-79 Using Slashes in Alternate Encoding attack pattern
  • CAPEC-8 Buffer Overflow in an API Call attack pattern
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic attack pattern
  • CAPEC-88 OS Command Injection attack pattern
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities attack pattern
  • CAPEC-92 Forced Integer Overflow attack pattern

Referenced by CVE · weakness (191)

  • CVE-2026-104198 ZoneMinder is a free, open source closed-circuit television software application. vulnerability
  • CVE-2026-108969 A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. vulnerability
  • CVE-2026-106252 Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code… vulnerability
  • CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients,… vulnerability
  • CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. vulnerability
  • CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. vulnerability
  • CVE-2026-85292 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. vulnerability
  • CVE-2026-79913 Cloudreve is a self-hosted file management and sharing system. vulnerability
  • CVE-2026-93957 A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. vulnerability
  • CVE-2026-57222 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. vulnerability
  • CVE-2026-61672 Capsule is a multi-tenancy and policy-based framework for Kubernetes. vulnerability
  • CVE-2026-61795 Capsule is a multi-tenancy and policy-based framework for Kubernetes. vulnerability
  • CVE-2026-71855 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. vulnerability
  • CVE-2026-90977 The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing… vulnerability
  • CVE-2026-20333 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software,… vulnerability
  • CVE-2026-92087 @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. vulnerability
  • CVE-2026-92395 @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify… vulnerability
  • CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and… vulnerability
  • CVE-2026-91851 Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. vulnerability
  • CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false,… vulnerability
  • CVE-2026-49846 libks provides foundational support for signalwire C products. vulnerability
  • CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root… vulnerability
  • CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within… vulnerability
  • CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to… vulnerability
  • CVE-2026-80227 Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or… vulnerability
  • CVE-2026-18664 When ranges are used for access control (i.e. vulnerability
  • CVE-2026-73258 Mongoose is an embedded web server and network library. vulnerability
  • CVE-2026-75110 MemOS is a memory operating system for LLMs and AI agents. vulnerability
  • CVE-2026-50029 js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built… vulnerability
  • CVE-2026-20765 Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of… vulnerability
Show all 191 ›

Referenced by CWE · can precede (1)

  • CWE-481 Assigning instead of Comparing weakness

Referenced by CWE · child of (9)

  • CWE-1023 Incomplete Comparison with Missing Factors weakness
  • CWE-1024 Comparison of Incompatible Types weakness
  • CWE-1025 Comparison Using Wrong Factors weakness
  • CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism weakness
  • CWE-1077 Floating Point Comparison with Incorrect Operator weakness
  • CWE-1254 Incorrect Comparison Logic Granularity weakness
  • CWE-183 Permissive List of Allowed Inputs weakness
  • CWE-185 Incorrect Regular Expression weakness
  • CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined weakness

Referenced by CWE · has member (2)

  • CWE-1000 Complete Weakness Hierarchy view
  • CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities view