CWE-477Use of Obsolete Function

Abstraction: Base · CVEs in our corpus: 16

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

As programming languages evolve, functions occasionally become obsolete due to: Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.

Last updated: 20 August 2026 13:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A03:2025 Software Supply Chain Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PM-15 Security and Privacy Groups and Associations
RA-4 Risk Assessment Update
SA-22 Unsupported System Components
SI-2 Flaw Remediation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control	Title	Family	Why it addresses this CWE
`PM-15`	Security and Privacy Groups and Associations	PM	Institutionalized information sharing keeps developers aware of obsolete functions and the need to replace them with supported alternatives.
`RA-4`	Risk Assessment Update	RA	Regular reassessment flags use of obsolete functions whose security properties have degraded or whose replacements contain fixes for known weaknesses.
`SA-22`	Unsupported System Components	SA	Eliminates reliance on functions or components explicitly declared obsolete and unsupported by their maintainers.
`SI-2`	Flaw Remediation	SI	Software and firmware updates replace obsolete functions whose retained presence leaves systems exposed to publicly known weaknesses.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-49212`	8.2	9.8	0.1004	2025-06-17
`CVE-2025-49213`	8.2	9.8	0.1004	2025-06-17
`CVE-2018-17890`	7.8	9.8	0.0326	2018-10-12
`CVE-2025-49220`	7.7	9.8	0.0201	2025-06-17
`CVE-2025-49219`	7.6	9.8	0.0137	2025-06-17
`CVE-2025-49217`	7.5	9.8	0.0106	2025-06-17
`CVE-2023-23451`	7.4	9.8	0.0062	2023-04-19
`CVE-2025-49216`	7.3	9.8	0.0051	2025-06-17
`CVE-2019-18251`	6.9	8.8	0.0174	2019-11-26
`CVE-2025-49214`	6.7	8.8	0.0077	2025-06-17
`CVE-2026-1693`	5.8	7.5	0.0031	2026-02-26
`CVE-2020-6978`	5.5	7.2	0.0078	2020-03-24
`CVE-2022-1384`	4.0	4.7	0.0066	2022-04-19
`CVE-2019-10968`	3.6	4.4	0.0034	2019-07-24
`CVE-2023-28829`	3.3	3.9	0.0029	2023-06-13
`CVE-2019-10988`	3.0	3.4	0.0034	2019-09-04