auren-research/cyber-sec huggingface dataset:
The product contains code that is not essential for execution,
i.e. makes no state changes and has no side effects that alter
data or control flow, such that removal of the code would have no impact
to functionality or correctness.
Irrelevant code could include dead code,
initialization that is not used, empty blocks, code that could be entirely
removed due to optimization, etc.

Resultant
Code might become accidentally irrelevant
due to other weaknesses, e.g. dead code or insecure
optimizations.

Indirect

Implementation

Other
Reduce Reliability

Other
Reduce Performance

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

The condition for the second if statement is impossible to satisfy. It requires that the variables be non-null. However, on the only path where s can be assigned a non-null value, there is a return statement.

String s = null;if (b) {s = "Yes";return;}
if (s != null) {Dead();}

The following code excerpt assigns to the variable r and then overwrites the value without using it.

r = getName();r = getNewBuffer(buf);

CVE-2014-1266
Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability. https://www.cve.org/CVERecord?id=CVE-2014-1266

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2019-01-02
3.2
2019-01-03

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Detection_Factors, Observed_Examples, Time_of_Introduction, Weakness_Ordinalities
The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
Many modern coding languages provide developers with input validation frameworks to make the task of input validation easier and less error-prone. These frameworks will automatically check all input against specified criteria and direct execution to error handlers when invalid input is received. The improper use (i.e., an incorrect implementation or missing altogether) of these frameworks is not directly exploitable, but can lead to an exploitable condition if proper input validation is not performed later in the product. Not using provided input validation frameworks can also hurt the maintainability of code as future developers may not recognize the downstream input validation being used in the place of the validation framework.

Indirect

Architecture and Design
This weakness may occur when software designers choose to not leverage input validation frameworks provided by the source language.

Implementation
This weakness may occur when developers do not correctly use a provided input validation framework.

Integrity
Unexpected State
Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others.

Automated Static Analysis

Some instances of improper input validation can be detected using automated static analysis.
A static analysis tool might allow the user to specify which application-specific methods or functions perform input validation; the tool might also have built-in knowledge of validation frameworks such as Struts. The tool may then suppress or de-prioritize any associated warnings. This allows the analyst to focus on areas of the software in which input validation does not appear to be present.
Except in the cases described in the previous paragraph, automated static analysis might not be able to recognize when proper input validation is being performed, leading to false positives - i.e., warnings that do not have any security consequences or require any code changes.

Implementation
Properly use provided input validation frameworks.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-12-21
3.2
2019-01-03

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes
The ASP.NET application does not use, or incorrectly uses, the model validation framework.

Indirect

Architecture and Design

Implementation

Integrity
Unexpected State
Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others.

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2018-12-21
3.2
2019-01-03

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships
The product performs CPU computations using
algorithms that are not as efficient as they could be for the
needs of the developer, i.e., the computations can be
optimized further.

Indirect

Primary

Architecture and Design

Implementation

Availability
Reduce Performance
DoS: Resource Consumption (CPU)
This issue can make the product perform more slowly, possibly in ways that are noticeable to the users. If an attacker can influence the amount of computation that must be performed, e.g. by triggering worst-case complexity, then this performance problem might introduce a vulnerability.

CVE-2022-37734
Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)
https://www.cve.org/CVERecord?id=CVE-2022-37734

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2019-01-03
3.2
2019-01-03

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Common_Consequences, Description
The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Primary

Resultant

Implementation

Other
Varies by Context

SFP8
Faulty Buffer Access

Discouraged
This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Community
2006-07-19
Draft 3
2006-07-19
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Name, Relationships

CWE Content Team
MITRE
2009-03-10
updated Description

CWE Content Team
MITRE
2009-05-27
updated Name

CWE Content Team
MITRE
2009-10-29
updated Relationships

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Name, Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Range Errors
Improper Access of Indexable Resource (aka 'Range Error')
Improper Access of Indexable Resource ('Range Error')
This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

CWE Content Team
MITRE
2019-03-25
3.3
2019-06-20

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Relationships, Type, Weakness_Ordinalities

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Use of Uninitialized Resource
The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.

DMA is included in a number of devices because it allows
data transfer between the computer and the connected device, using
direct hardware access to read or write directly to main memory
without any OS interaction. An attacker could exploit this to
access secrets. Several virtualization-based mitigations have been introduced to thwart DMA attacks. These are usually
configured/setup during boot time. However, certain IPs that are
powered up before boot is complete (known as early boot IPs) may
be DMA capable. Such IPs, if not trusted, could launch DMA
attacks and gain access to assets that should otherwise be
protected.

Primary

Architecture and Design

Access Control
Bypass Protection Mechanism
Modify Memory
High
DMA devices have direct write access to main memory and
due to time of attack will be able to bypass OS or Bootloader
access control.

Architecture and Design
Utilize an IOMMU to orchestrate IO access from
the start of the boot process.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2019-10-15
4.0
2020-02-24

CWE Content Team
MITRE
2020-08-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.

A System-on-Chip (SoC) comprises several components (IP) with varied
trust requirements. It is required that each IP is identified
uniquely and should distinguish itself from other entities in
the SoC without any ambiguity. The unique secured identity is
required for various purposes. Most of the time the identity is used
to route a transaction or perform certain actions, including
resetting, retrieving a sensitive information, and acting upon or on
behalf of something else.
There are several variants of this weakness:

A "missing" identifier is when the SoC does not define
any mechanism to uniquely identify the IP.
An "insufficient" identifier might provide
some defenses - for example, against the most common
attacks - but it does not protect against everything
that is intended.
A "misconfigured" mechanism occurs when a mechanism
is available but not implemented correctly.
An "ignored" identifier occurs when the SoC/IP has not applied
any policies or does not act upon the identifier securely.

Primary

Resultant

Architecture and Design

Implementation

Operation

Access Control
Bypass Protection Mechanism
High

Architecture and Design
Separation of Privilege

Every identity generated in the SoC should be unique and
immutable in hardware. The actions that an IP is trusted or
not trusted should be clearly defined, implemented,
configured, and tested. If the definition is implemented via a
policy, then the policy should be immutable or protected with
clear authentication and authorization.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2019-10-15
4.0
2020-02-24

CWE Content Team
MITRE
2020-08-20
updated Description

CWE Content Team
MITRE
2020-12-10
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Name

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

System-on-Chip (SoC) Using Components without Unique, Immutable Identifiers
The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.

After initial reset, System-on-Chip (SoC) fabric access controls and other
security features need to be programmed by trusted firmware as part
of the boot sequence. If untrusted IPs or peripheral microcontrollers
are enabled first, then the untrusted component can master
transactions on the hardware bus and target memory or other assets to
compromise the SoC boot firmware.

Primary

Architecture and Design

Access Control
Bypass Protection Mechanism
High
An untrusted component can master transactions on the HW bus and target memory or other assets to compromise the SoC boot firmware.

Architecture and Design

The boot sequence should enable fabric access controls and memory protections before enabling third-party hardware IPs and peripheral microcontrollers that use untrusted firmware.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2019-10-15
4.0
2020-02-24

CWE Content Team
MITRE
2020-08-20
updated References, Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities
The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.

A product is only expected to behave in a way that was specifically intended by the developer. Resource allocation and management is expected to be performed explicitly by the associated code. However, in systems with complex behavior, the product might indirectly produce new kinds of resources that were never intended in the original design. For example, a covert channel is a resource that was never explicitly intended by the developer, but it is useful to attackers. "Parasitic computing," while not necessarily malicious in nature, effectively tricks a product into performing unintended computations on behalf of another party.

Resultant

Implementation

Architecture and Design

Other
Varies by Context

In this example, the attacker observes how long an authentication takes when the user types in the correct password.
When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

def validate_password(actual_pw, typed_pw):

if len(actual_pw) <> len(typed_pw):
return 0
for i in len(actual_pw):
if actual_pw[i] <> typed_pw[i]:
return 0

return 1

Note that in this example, the actual password must be handled in constant time as far as the attacker is concerned, even if the actual password is of an unusual length. This is one reason why it is good to use an algorithm that, among other things, stores a seeded cryptographic one-way hash of the password, then compare the hashes, which will always be of the same length.

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Content Team
MITRE
2020-01-22
4.0
2020-02-24

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Demonstrative_Examples, Time_of_Introduction, Weakness_Ordinalities
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.

Developers might correctly prevent unauthorized access to a database or other resource containing sensitive information, but they might not consider that portions of the original information might also be recorded in metadata, search indices, statistical reports, or other resources. If these resources are not also restricted, then attackers might be able to extract some or all of the original information, or otherwise infer some details. For example, an attacker could specify search terms that are known to be unique to a particular person, or view metadata such as activity or creation dates in order to identify usage patterns.

Primary

Resultant

Architecture and Design

Confidentiality
Read Application Data

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2020-01-26
4.0
2020-02-24

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Weakness_Ordinalities
Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.

The functionality and security of the system heavily depend on the implementation of FSMs. FSMs can be used to indicate the current security state of the system. Lots of secure data operations and data transfers rely on the state reported by the FSM.

Resultant

Architecture and Design

Implementation

Availability
Access Control
Unexpected State
DoS: Crash, Exit, or Restart
DoS: Instability
Gain Privileges or Assume Identity
Faulty FSM designs that do not account for all states, either through undefined states (left as don't cares) or through incorrect implementation, might lead an attacker to drive the system into an unstable state from which the system cannot recover without a reset, thus causing a DoS. Depending on what the FSM is used for, an attacker might also gain additional privileges to launch further attacks and compromise the security guarantees.

Architecture and Design
Implementation
Define all possible states and handle all unused states through default statements. Ensure that system defaults to a secure state.
High

The Finite State Machine (FSM) shown in the "bad" code snippet below assigns the output ("out") based on the value of state, which is determined based on the user provided input ("user_input").

module fsm_1(out, user_input, clk, rst_n);
input [2:0] user_input;
input clk, rst_n;
output reg [2:0] out;
reg [1:0] state;
always @ (posedge clk or negedge rst_n )

begin

if (!rst_n)

state = 3'h0;

else
case (user_input)

3'h0:
3'h1:
3'h2:
3'h3: state = 2'h3;
3'h4: state = 2'h2;
3'h5: state = 2'h1;

endcase

end
out <= {1'h1, state};

endmodule

The case statement does not include a default to handle the scenario when the user provides inputs of 3'h6 and 3'h7. Those inputs push the system to an undefined state and might cause a crash (denial of service) or any other unanticipated outcome.
Adding a default statement to handle undefined inputs mitigates this issue. This is shown in the "Good" code snippet below. The default statement is in bold.

case (user_input)
3'h0:
3'h1:
3'h2:
3'h3: state = 2'h3;
3'h4: state = 2'h2;
3'h5: state = 2'h1;
default: state = 2'h0;

endcase

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2020-02-12
4.0
2020-02-24

CWE Content Team
MITRE
2020-08-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2022-10-13
updated Demonstrative_Examples

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Common_Consequences, Description, Weakness_Ordinalities