CWE-697: Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect.

This Pillar covers several possibilities: the comparison checks one factor incorrectly; the comparison should consider multiple factors, but it does not check at least one of those factors at all; the comparison checks the wrong factor.

Consequences

• Other: Varies by Context

Recent advisories

• GHSA-rpw4-54j3-4h4q — ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
• GHSA-j6r3-76f7-8jcv — ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
• GHSA-jqcg-44mw-7w3h — proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
• EEF-CVE-2026-80227 — SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
• GHSA-39q2-94rc-95cp — DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
• GHSA-f6j3-w9v3-cq22 — Parse Server has a session field immutability bypass via falsy-value guard
• GHSA-7wx9-6375-f5wh — PickleScan's profile.run blocklist mismatch allows exec() bypass
• GHSA-4v8w-gg5j-ph37 — MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
• GHSA-75c5-xw7c-p5pm — PyJWT Issuer field partial matches allowed
• GHSA-mchx-7j67-8mcf — Casdoor CORS misconfiguration (GHSL-2024-035)
• CVE-2024-5217 — ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases.
• GHSA-3wc5-fcw2-2329 — KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols
• GHSA-67hx-6x53-jw92 — Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
• GHSA-f637-vh3r-vfh2 — TensorFlow has Floating Point Exception in AudioSpectrogram
• GHSA-rcf8-g8jv-vg6p — TensorFlow has Floating Point Exception in AvgPoolGrad with XLA

All advisories for CWE-697