The product contains dead code, which can never be executed.
Dead code is code that can never be executed in a running program. The surrounding code makes it impossible for a section of code to ever be executed.

Indirect

Implementation

Other
Quality Degradation
Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.

Other
Reduce Maintainability

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction

Cost effective for partial coverage:

Attack Modeling

High

Automated Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Binary / Bytecode Quality Analysis
Compare binary / bytecode to application permission manifest

High

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Automated Monitored Execution

SOAR Partial

Automated Static Analysis

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Permission Manifest Analysis

SOAR Partial

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Source Code Quality Analyzer

Cost effective for partial coverage:

Warning Flags
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer

High

Dynamic Analysis with Automated Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Web Application Scanner
Web Services Scanner
Database Scanners

SOAR Partial

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Manual Source Code Review (not inspections)

Cost effective for partial coverage:

Focused Manual Spotcheck - Focused manual analysis of source

High

Implementation
Remove dead code before deploying the application.

Testing
Use a static analysis tool to spot dead code.

The condition for the second if statement is impossible to satisfy. It requires that the variables be non-null. However, on the only path where s can be assigned a non-null value, there is a return statement.

String s = null;if (b) {s = "Yes";return;}
if (s != null) {Dead();}

In the following class, two private methods call each other, but since neither one is ever invoked from anywhere else, they are both dead code.

public class DoubleDead {private void doTweedledee() {doTweedledumb();}private void doTweedledumb() {doTweedledee();}public static void main(String[] args) {System.out.println("running DoubleDead");}}

(In this case it is a good thing that the methods are dead: invoking either one would cause an infinite loop.)

The field named glue is not used in the following class. The author of the class has accidentally put quotes around the field name, transforming it into a string constant.

public class Dead {
String glue;
public String getGlue() {return "glue";}
}

CVE-2014-1266
Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.
https://www.cve.org/CVERecord?id=CVE-2014-1266

MSC07-C
Detect and remove dead code

MSC00-PL
Detect and remove dead code
Exact

SFP2
Unused Entities

ASCMM-MNT-20

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Anonymous Tool Vendor (under NDA)
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2009-07-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2009-10-29
updated Common_Consequences, Other_Notes

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-06-23
updated Observed_Examples

CWE Content Team
MITRE
2014-07-30
updated Detection_Factors, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Common_Consequences, References, Relationships, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2019-06-20
updated Type

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Observed_Examples, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Observed_Examples

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Detection_Factors, References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Observed_Examples