logo

Dead Code

Draft Base
Structure: Simple
Description

Dead code refers to sections of a program that can never run during normal execution, effectively making them inactive and unreachable.

Extended Description

Dead code occurs when logic within the program, such as conditional statements or function calls, permanently prevents its execution. This often results from overly restrictive conditions, code that's been commented out but left in place, or legacy functions that are no longer invoked after software updates. While not directly exploitable like a vulnerability, it bloats the codebase, obscures real issues during security reviews, and can mislead developers about the program's actual behavior. From a security and maintenance perspective, dead code creates unnecessary noise during static analysis and manual audits, potentially causing real vulnerabilities to be overlooked. It also increases the attack surface by adding complexity without providing value. Regularly removing dead code through refactoring and using code coverage tools helps keep the application lean, understandable, and easier to secure.
Common Consequences 2
Scope: Other

Impact: Quality Degradation

Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.

Scope: Other

Impact: Reduce Maintainability
Detection Methods 7
Architecture or Design ReviewHigh
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction ``` Cost effective for partial coverage: ``` Attack Modeling
Automated Static Analysis - Binary or BytecodeHigh
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Binary / Bytecode Quality Analysis Compare binary / bytecode to application permission manifest
Dynamic Analysis with Manual Results InterpretationSOAR Partial
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Automated Monitored Execution
Automated Static AnalysisSOAR Partial
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Permission Manifest Analysis
Automated Static Analysis - Source CodeHigh
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Source Code Quality Analyzer ``` Cost effective for partial coverage: ``` Warning Flags Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Dynamic Analysis with Automated Results InterpretationSOAR Partial
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Web Application Scanner Web Services Scanner Database Scanners
Manual Static Analysis - Source CodeHigh
According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Manual Source Code Review (not inspections) ``` Cost effective for partial coverage: ``` Focused Manual Spotcheck - Focused manual analysis of source
Potential Mitigations 2
Phase: Implementation
Remove dead code before deploying the application.
Phase: Testing
Use a static analysis tool to spot dead code.
Demonstrative Examples 3

ID : DX-217

The condition for the second if statement is impossible to satisfy. It requires that the variables be non-null. However, on the only path where s can be assigned a non-null value, there is a return statement.

Code Example:

Bad
C++
c++
In the following class, two private methods call each other, but since neither one is ever invoked from anywhere else, they are both dead code.

Code Example:

Bad
Java
java
(In this case it is a good thing that the methods are dead: invoking either one would cause an infinite loop.)
The field named glue is not used in the following class. The author of the class has accidentally put quotes around the field name, transforming it into a string constant.

Code Example:

Bad
Java
java
Observed Examples 1
CVE-2014-1266chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). Incorrect Control Flow Scoping (Incorrect Control Flow Scoping) -> Dead Code (Dead Code) -> Improper Certificate Validation (Improper Certificate Validation) -> Return of Wrong Status Code (Return of Wrong Status Code) -> Channel Accessible by Non-Endpoint (Channel Accessible by Non-Endpoint).
References 2
Automated Source Code Maintainability Measure (ASCMM)
Object Management Group (OMG)
01-2016
https://www.omg.org/spec/ASCMM/(2023-04-07)
ID: REF-960
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, and Rama S. Moorthy
07-2014
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx(2025-09-05)
ID: REF-1479
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Implementation
Related Weaknesses
ChildOf: Irrelevant Code (CWE-1164)
Taxonomy Mapping
  • CERT C Secure Coding
  • SEI CERT Perl Coding Standard
  • Software Fault Patterns
  • OMG ASCMM