CWEweakness
CWE-1104 Use of Unmaintained Third Party Components
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product relies on third-party components that are not
actively supported or maintained by the original developer or a trusted proxy
for the original developer.
Common consequences
• Other: Reduce Maintainability, Varies by Context — Relying on unmaintained components makes it difficult or impossible to fix significant bugs and vulnerabilities, can render code obsolete, and undermine security by complicating maintenance and increasing the risk of new vulnerabilities.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2025-40906: Perl module for BSON serialization includes a component that reached end-of-life approximately five years previously, but has multiple vulnerabilities.
• CVE-2024-35252: Closed-source cloud storage product includes an unmaintained third-party component that allows denial of service
Related
Observed example · CVE (2)
- CVE-2025-40906 BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. vulnerability
- CVE-2024-35252 Azure Storage Movement Client Library Denial of Service Vulnerability vulnerability
Child of · CWE (1)
- CWE-1357 Reliance on Insufficiently Trustworthy Component weakness
Referenced by CVE · weakness (30)
- CVE-2026-82935 mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. vulnerability
- CVE-2026-21753 HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious… vulnerability
- CVE-2026-12554 Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. vulnerability
- CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the… vulnerability
- CVE-2026-66788 A flaw was found in Lighthouse. vulnerability
- CVE-2026-11325 Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote… vulnerability
- CVE-2026-16634 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. vulnerability
- CVE-2026-60368 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). vulnerability
- CVE-2026-56580 HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). vulnerability
- CVE-2026-3031 Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. vulnerability
- CVE-2023-37524 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. vulnerability
- CVE-2026-21821 The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. vulnerability
- CVE-2026-41468 Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. vulnerability
- CVE-2025-55277 HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits… vulnerability
- CVE-2025-20010 Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User… vulnerability
- CVE-2025-12104 Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through… vulnerability
- CVE-2025-52658 HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could… vulnerability
- CVE-2025-34192 Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140… vulnerability
- CVE-2025-34193 Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include… vulnerability
- CVE-2025-10220 Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on… vulnerability
- CVE-2025-48862 Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted… vulnerability
- CVE-2025-3497 The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on… vulnerability
- CVE-2025-40906 BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. vulnerability
- CVE-2024-11999 CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an… vulnerability
- CVE-2024-8885 A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows… vulnerability
- CVE-2024-35252 Azure Storage Movement Client Library Denial of Service Vulnerability vulnerability
- CVE-2024-21631 Vapor is an HTTP web framework for Swift. vulnerability
- CVE-2023-7102 Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. vulnerability
- CVE-2021-22142 Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. vulnerability
- CVE-2022-46871 An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. vulnerability