CWE-187 Partial String Comparison
Description
The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-187 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-88h9-xgvx-hvf2 | CVE-2026-101914 | MODERATE |
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches |
2026-09-28 | |
| GHSA-376h-93r7-7g6f | CVE-2026-84376 | MODERATE |
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base |
2026-09-08 | |
| GHSA-x5w9-xh9r-mvfc | CVE-2026-45692 | MODERATE |
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization |
2026-07-20 | |
| GHSA-64mm-vxmg-q3vj | CVE-2026-55602 | MODERATE |
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass |
2026-06-22 | |
| GHSA-hg3h-g7xc-f7vp | CVE-2026-44837 | MODERATE |
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape |
2026-06-08 | |
| GHSA-h2jq-g4cq-5ppq | CVE-2026-34785 | HIGH |
Rack::Static prefix matching can expose unintended files under the static root |
2026-05-13 | |
| GHSA-mxh2-ccgj-8635 | CVE-2025-57808 | HIGH |
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header |
2025-09-02 | |
| GHSA-v23v-6jw2-98fq | CVE-2024-41110 | CRITICAL |
Authz zero length regression |
2024-08-09 |