CWE-1093, Excessively Complex Data Representation, describes a product that uses an unnecessarily complex internal representation for its data structures or the relationships between them.
It is a Class level entry, which means it is broad. MITRE marks it as allowed with review: it could be used to map real vulnerabilities in limited situations, and the advice is to look at its more specific children for a better fit.
How it happens
Complexity accumulates when data models grow without pruning.
- A record holds the same fact in three fields that must be kept in sync.
- Nested structures go five levels deep when two would do.
- A generic container stores mixed types, and every reader guesses.
- Relationships between objects form cycles that nobody documents.
# Smell: the same state, spread across loosely related structures
user = {
"id": 7,
"roles": ["admin"],
"role_flags": {"is_admin": True, "is_staff": True},
"perm_cache": {"admin": {"read": True, "write": True}},
}
Three fields say whether this user is an admin. If one is updated and the others are not, code that checks a different field gets a different answer. That is how authorization drift starts.
What an attacker gains
The listed consequences are reduced maintainability, increased analytical complexity and reduced performance. MITRE says the security effect is indirect: complexity makes vulnerabilities harder to find and fix. The authorization example above shows how it can turn into a direct problem when copies fall out of step.
How to find it
- Review the main data models for duplicated facts and deep nesting.
- Ask a new team member to explain the model. Where they get lost is where bugs hide.
- Use static analysis and complexity metrics to point at the worst structures.
How to fix it
- Keep one source of truth for each fact and derive the rest on demand.
- Flatten nesting where it adds nothing.
- Use typed structures with fixed fields instead of loose dictionaries.
- Document the relationships that remain, especially cycles.
- Refactor behind tests, one structure at a time.
Quick check
Why can duplicated state become a security bug?
If two fields describe the same permission and only one is updated, different code paths can disagree about what a user may do.
