CWE-595: Comparison of Object References Instead of Object Contents

Code Examples & CVEs

Demonstrative Examples

In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.

However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method:

BadJava

String str1 = new String("Hello");String str2 = new String("Hello");if (str1 == str2) {System.out.println("str1 == str2");}

In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.

GoodJava

if (str1.equals(str2)) {System.out.println("str1 equals str2");}

In the following Java example, two BankAccount objects are compared in the isSameAccount method using the == operator.

Using the == operator to compare objects may produce incorrect or deceptive results by comparing object references rather than values. The equals() method should be used to ensure correct results or objects should contain a member variable that uniquely identifies the object.

BadJava

public boolean isSameAccount(BankAccount accountA, BankAccount accountB) {return accountA == accountB;}

In the following Java example, two BankAccount objects are compared in the isSameAccount method using the == operator.

GoodJava

public boolean isSameAccount(BankAccount accountA, BankAccount accountB) {return accountA.equals(accountB);}

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-595 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-595, Comparison of Object References Instead of Object Contents, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Comparison of Object References Instead of Object Contents during Implementation

MITRE associates mitigation with Implementation; documented detection approaches include Automated Static Analysis; recorded impacts include Varies by Context. Use these source-defined anchors to turn CWE-595 into implementation, review, and verification checks for the affected component.

CWE-595: Comparison of Object References Instead of Object Contents — MITRE CWE

Triage CWE-595 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-595, Comparison of Object References Instead of Object Contents, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-595

Apply MITRE's full root-cause mapping guidance when using CWE-595, Comparison of Object References Instead of Object Contents. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-595 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-595, Comparison of Object References Instead of Object Contents. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-595: Comparison of Object References Instead of Object Contents?+

CWE-595: Comparison of Object References Instead of Object Contents is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects. For example, in Java, comparing objects using == usually produces deceptive results, since the == operator compares object references rather than values; often, this means that using == for strings is actually comparing the strings' references, not their values.

What are the security consequences of Comparison of Object References Instead of Object Contents?+

If exploited, CWE-595 (Comparison of Object References Instead of Object Contents) it can compromise Other, leading to outcomes such as Varies by Context.

How do you prevent or mitigate Comparison of Object References Instead of Object Contents?+

Recommended mitigations for CWE-595 include: In Java, use the equals() method to compare objects instead of the == operator. If using ==, it is important for performance reasons that your objects are created by a static factory, not by a constructor.

Which programming languages are affected by Comparison of Object References Instead of Object Contents?+

CWE-595 commonly affects Java, JavaScript, PHP and Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-595 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-595: Comparison of Object References Instead of Object Contents

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods