CWE-1122 is code structured so that a Halstead complexity measure exceeds a desirable maximum. MITRE's extended description notes that many Halstead measures exist, such as program vocabulary size or volume.
MITRE marks the entry as a quality issue with no direct security implications and prohibits mapping real vulnerabilities to it.
How it happens
Halstead measures count the distinct operators and operands in code and how often they appear. A function packed with many different symbols, long expressions and repeated tokens scores high. Dense one-liners and clever expression chains are typical causes.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and increased analytical complexity: harder to understand and maintain, which indirectly makes vulnerabilities more difficult and time-consuming to find and fix, and might make them easier to introduce.
How to find it
The record lists no detection methods. Some analysis tools report Halstead metrics. If yours does, set a threshold and review the highest scoring functions first.
How to fix it
The record has no formal mitigations. Break long expressions into named intermediate values, split large functions, and prefer plain constructs over compact tricks. Reaching for fewer distinct concepts per function usually lowers the score and helps the reader.
Quick check
How is this different from cyclomatic complexity?
Cyclomatic complexity counts paths. Halstead measures count the vocabulary and volume of operators and operands.
