This weakness occurs when software relies on functions, APIs, or libraries that have been deprecated or marked obsolete by their maintainers. Obsolete…
This weakness occurs when software relies on functions, APIs, or libraries that have been deprecated or marked obsolete by their maintainers. Obsolete functions are often replaced because they lack security hardening, have known performance issues, or have been superseded by safer alternatives. Using them leaves your application vulnerable to bugs and security flaws that the maintainers no longer patch.
Developers often inherit or maintain codebases written years ago, and may not realize that the functions they're calling have been officially deprecated. Language maintainers, framework authors, and library developers regularly retire old APIs in favor of newer, safer versions—but legacy code continues to use them. Sometimes the old function still works, which creates a false sense of security; the real risk emerges when security issues are discovered in the obsolete function and patches are only released for its replacement, or when the function is removed entirely in a major version upgrade.
Relying on obsolete functions can lead to unpatched security vulnerabilities, unexpected behavior changes across platform updates, and compatibility breaks when dependencies are upgraded. In some cases, deprecated functions are removed without warning in major releases, causing application crashes. More critically, obsolete cryptographic or authentication functions may have known weaknesses that attackers can exploit, and security patches may never be backported to the old API.
import hashlib
def hash_password(password):
# md5 is cryptographically broken and should not be used
return hashlib.md5(password.encode()).hexdigest()
stored_hash = hash_password("user_password")Why it's vulnerable:
MD5 is obsolete for security purposes; it has known collision vulnerabilities and is no longer considered suitable for password hashing. Python's documentation explicitly warns against its use for cryptographic purposes.
import hashlib
def hash_password(password):
# Use a modern, purpose-built password hashing algorithm
import bcrypt
return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
stored_hash = hash_password("user_password")<?php
// Using deprecated mysql_* functions (removed in PHP 7.0)
$connection = mysql_connect("localhost", "user", "pass");
mysql_select_db("database", $connection);
$result = mysql_query("SELECT * FROM users WHERE id = " . $_GET['id']);
$row = mysql_fetch_assoc($result);
?>Why it's vulnerable:
The mysql_* functions were deprecated in PHP 5.5 and removed entirely in PHP 7.0. They lack prepared statement support, making SQL injection trivial, and are no longer maintained.
<?php
// Using modern MySQLi with prepared statements
$connection = new mysqli("localhost", "user", "pass", "database");
$stmt = $connection->prepare("SELECT * FROM users WHERE id = ?");
$stmt->bind_param("i", $_GET['id']);
$stmt->execute();
$result = $stmt->get_result();
$row = $result->fetch_assoc();
?>pip list --outdated (Python) or composer outdated (PHP) to identify packages with available updates, and check their changelogs for deprecation notices.
pylint, phpstan).
Check your codebase for calls to functions your language or framework has marked deprecated (search your documentation or changelogs for "deprecated" or "obsolete"). Review your dependency versions; if any are several major versions behind the latest stable release, they may contain unpatched security issues. If you encounter errors like "function not found" or "undefined method" after upgrading a dependency, you may have hit a removed API.
