CWE-561

Dead Code

Base

Draft

Description

The product contains dead code, which can never be executed.

Dead code is code that can never be executed in a running program. The surrounding code makes it impossible for a section of code to ever be executed.

Parent Weaknesses (ChildOf)

CWE-1164: Irrelevant Code...

Common Consequences

Scope

Other

Impact

Quality Degradation

Scope

Other

Impact

Reduce Maintainability

Potential Mitigations

Implementation

Remove dead code before deploying the application.

CVE-2014-1266

Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Applicable Platforms

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now