Mind the Gap: SAST Tools × Language-Specific Top CWEs

Language-Specific Distribution of Top CWEs

What is the language-specific distribution of top CWEs in real-world vulnerabilities across C/C++, Java, and Python?

CVE Trends (2016–2025)

C/C++

205

Top CWEs

37,887

CVEs

116

Covered

Java

123

Top CWEs

6,703

CVEs

97

Covered

Python

86

Top CWEs

1,915

CVEs

74

Covered

Root CWE Distribution by Language

Percentage of CVEs across the 10 root CWE categories in CWE View 1000

Finding 1: Across all three languages, CWE-664 (Improper Control of a Resource Through its Lifetime) and CWE-707 (Improper Neutralization) are the most frequent root CWE categories. The third most frequent varies: for C/C++ it is CWE-710 (Improper Adherence to Coding Standard), whereas for Java and Python it is CWE-284 (Improper Access Control).

Language-Specific vs. General CWE Top 25

Comparing language-specific Top 25 CWEs with the general CWE Top 25 benchmark

Jaccard Similarity set-level overlap

RBO (q=0.9) rank-aware similarity

Top 25 CWE Lists — Side by Side

Top_C/C++ 25

Top_C/C++ 25 (CVSS)

Top_Java 25

Top_Java 25 (CVSS)

Top_Python 25

Top_Python 25 (CVSS)

Cross-Comparison Similarity Matrix

	C/C++	C/C++ (CVSS)	Java	Java (CVSS)	Python	Python (CVSS)	NIST
C/C++ Jaccard	1	0.67	0.11	0.16	0.16	0.16	0.32
C/C++ (CVSS) Jaccard	0.67	1	0.19	0.22	0.22	0.22	0.43
Java Jaccard	0.11	0.19	1	0.56	0.47	0.43	0.35
Java (CVSS) Jaccard	0.16	0.22	0.56	1	0.47	0.56	0.39
Python Jaccard	0.16	0.22	0.47	0.47	1	0.56	0.28
Python (CVSS) Jaccard	0.16	0.22	0.43	0.56	0.56	1	0.32
NIST Jaccard	0.32	0.43	0.35	0.39	0.28	0.32	1

	C/C++	C/C++ (CVSS)	Java	Java (CVSS)	Python	Python (CVSS)	NIST
C/C++ RBO (q=0.9)	1	0.55	0.04	0.07	0.02	0.06	0.17
C/C++ (CVSS) RBO (q=0.9)	0.55	1	0.02	0.05	0.07	0.07	0.19
Java RBO (q=0.9)	0.04	0.02	1	0.62	0.29	0.38	0.54
Java (CVSS) RBO (q=0.9)	0.07	0.05	0.62	1	0.39	0.56	0.41
Python RBO (q=0.9)	0.02	0.07	0.29	0.39	1	0.59	0.14
Python (CVSS) RBO (q=0.9)	0.06	0.07	0.38	0.56	0.59	1	0.19
NIST RBO (q=0.9)	0.17	0.19	0.54	0.41	0.14	0.19	1

Finding 2: The language-specific Top CWE lists differ substantially from the general CWE Top 25 — RBO scores for Top_C/C++ (0.17) and Top_Python (0.14) against the general list do not exceed 0.2. Java aligns more closely (RBO = 0.54), suggesting the general ranking is biased toward Java.

Top CWE Coverage Gaps in SAST Tools

To what extent are top CWEs covered by existing SAST tools, and what causes non-coverage?

Overall Coverage

C/C++

56.59%

116 / 205 Top CWEs Covered

Java

78.86%

97 / 123 Top CWEs Covered

Python

86.05%

74 / 86 Top CWEs Covered

Coverage by Root CWE Category per Language

Finding 3: The whole SAST tool set shows low coverage of the Top_Lan CWE list. C/C++ is the lowest at 56.59%. Enhancing C/C++ detection must be a critical priority.

Uncovered High-Frequency CWEs — Detailed View

C/C++ Java Python

C/C++ Missed (65)

Java Missed (17)

Python Missed (9)

Why Are These CWEs Uncovered?

Four categories of reasons for non-coverage by SAST tools

Reason Breakdown by Language

Classification Categories

① Dynamic Data Value Dependence

Vulnerabilities depending on runtime variable values, computation results, or memory states that SAST tools cannot reliably predict.

② Project Configuration & Environment Dependence

Vulnerabilities tied to project-specific business logic, security policies, and unique factors such as industry standards or system configurations.

③ System Timing & Hardware Interaction Dependence

Vulnerabilities stemming from thread scheduling, event ordering, and physical/hardware states that static analysis cannot model.

④ Complex Input & Sequence Dependence

Vulnerabilities triggered by specific external inputs or event sequences that static analysis cannot exhaustively examine.

Uncovered CWE Reason Counts

Language	Dynamic Data Value	Project Config & Environment	System Timing & Hardware	Complex Input & Sequence	Total
C/C++	10	31	7	17	65
Java	4	6	4	3	17
Python	3	1	3	2	9

Finding 4: Missed top CWEs occur primarily in C/C++. Project Configuration and Environment Dependence accounts for the largest share. About 60% of these gaps can be addressed by hybrid methods (LLMs + runtime info), while timing and complex input dependencies remain largely unresolved.

Uncovered CWEs with Reason Classification

Uncovered CWEs per language and their reason categories

CWE-ID	Name	Classification

CWE-ID	Name	Classification

CWE-ID	Name	Classification

CWE Coverage Variation Across SAST Tools

What differences exist in coverage across different SAST tools, and how do multi-language tools cover shared top CWEs?

Coverage by Tool per Language

Top CWE Coverage by Tool

Tool Coverage Details

Language	Tool	Covered CWEs	Covered Top CWEs	Coverage %	Tool-Only Top CWEs	Tool-Only CWEs
C/C++	CodeQL	156	108	52.68%	45	77
	Cppcheck	52	34	16.59%	2	8
	Semgrep	28	22	10.73%	2	3
	CSA	24	17	8.29%	1	5
	Flawfinder	47	40	19.51%	3	4
Java	CodeQL	220	92	74.80%	12	71
	SonarQube	142	61	49.59%	4	27
	SpotBugs	106	65	52.85%	1	17
	Semgrep	77	57	46.34%	0	2
	Insider	44	36	29.27%	0	1
Python	CodeQL	137	67	77.91%	6	36
	Semgrep	89	60	69.77%	4	15
	SonarQube	92	47	54.65%	0	13
	Bandit	45	36	41.86%	2	6

Tool-Only CWE Details

CWE IDs unique to each tool (not covered by any other tool in the same language)

CodeQL — Tool-Only Top CWEs (45)

CWE-23, CWE-73, CWE-79, CWE-88, CWE-89, CWE-121, CWE-122, CWE-129, CWE-191, CWE-193, CWE-228, CWE-252, CWE-266, CWE-271, CWE-273, CWE-287, CWE-290, CWE-295, CWE-311, CWE-312, CWE-319, CWE-326, CWE-345, CWE-359, CWE-369, CWE-401, CWE-405, CWE-428, CWE-497, CWE-522, CWE-610, CWE-611, CWE-642, CWE-772, CWE-789, CWE-805, CWE-823, CWE-835, CWE-843, CWE-909, CWE-922, CWE-943, CWE-1023, CWE-1285, CWE-1390

CodeQL — Tool-Only CWEs (77)

CWE-23, CWE-36, CWE-73, CWE-79, CWE-88, CWE-89, CWE-114, CWE-121, CWE-122, CWE-128, CWE-129, CWE-170, CWE-191, CWE-192, CWE-193, CWE-228, CWE-233, CWE-234, CWE-243, CWE-252, CWE-253, CWE-260, CWE-266, CWE-271, CWE-273, CWE-287, CWE-290, CWE-295, CWE-311, CWE-312, CWE-313, CWE-319, CWE-326, CWE-345, CWE-359, CWE-369, CWE-390, CWE-401, CWE-405, CWE-409, CWE-428, CWE-456, CWE-468, CWE-478, CWE-481, CWE-482, CWE-497, CWE-522, CWE-546, CWE-560, CWE-561, CWE-610, CWE-611, CWE-642, CWE-685, CWE-686, CWE-687, CWE-764, CWE-772, CWE-775, CWE-789, CWE-805, CWE-823, CWE-826, CWE-835, CWE-843, CWE-909, CWE-922, CWE-943, CWE-1023, CWE-1041, CWE-1076, CWE-1078, CWE-1126, CWE-1240, CWE-1285, CWE-1390

Cppcheck — Tool-Only Top CWEs (2)

CWE-763, CWE-786

Cppcheck — Tool-Only CWEs (8)

CWE-195, CWE-571, CWE-590, CWE-688, CWE-762, CWE-763, CWE-786, CWE-910

Semgrep Top (2)

CWE-532, CWE-538

Semgrep All (3)

CWE-532, CWE-538, CWE-774

CSA Top (1)

CWE-338

CSA All (5)

CWE-338, CWE-466, CWE-469, CWE-477, CWE-588

Flawfinder — Tool-Only Top CWEs (3)

CWE-250, CWE-657, CWE-829

Flawfinder — Tool-Only CWEs (4)

CWE-250, CWE-657, CWE-785, CWE-829

CodeQL — Tool-Only Top CWEs (12)

CWE-73, CWE-201, CWE-266, CWE-290, CWE-362, CWE-367, CWE-674, CWE-772, CWE-829, CWE-834, CWE-835, CWE-862

CodeQL — Tool-Only CWEs (71)

CWE-36, CWE-73, CWE-88, CWE-129, CWE-185, CWE-192, CWE-193, CWE-197, CWE-201, CWE-208, CWE-252, CWE-260, CWE-266, CWE-271, CWE-273, CWE-290, CWE-299, CWE-300, CWE-313, CWE-348, CWE-362, CWE-367, CWE-383, CWE-420, CWE-421, CWE-457, CWE-497, CWE-499, CWE-524, CWE-543, CWE-548, CWE-555, CWE-561, CWE-570, CWE-571, CWE-574, CWE-575, CWE-576, CWE-577, CWE-578, CWE-580, CWE-585, CWE-598, CWE-625, CWE-628, CWE-652, CWE-674, CWE-675, CWE-676, CWE-681, CWE-685, CWE-764, CWE-772, CWE-776, CWE-783, CWE-820, CWE-827, CWE-829, CWE-833, CWE-834, CWE-835, CWE-862, CWE-908, CWE-939, CWE-1071, CWE-1104, CWE-1176, CWE-1177, CWE-1285, CWE-1336, CWE-1357

SonarQube — Tool-Only Top CWEs (4)

CWE-377, CWE-427, CWE-471, CWE-770

SonarQube — Tool-Only CWEs (27)

CWE-223, CWE-331, CWE-332, CWE-336, CWE-377, CWE-379, CWE-395, CWE-397, CWE-412, CWE-426, CWE-427, CWE-471, CWE-483, CWE-486, CWE-493, CWE-500, CWE-521, CWE-579, CWE-583, CWE-594, CWE-607, CWE-673, CWE-760, CWE-770, CWE-778, CWE-1240, CWE-1241

SpotBugs Top (1)

CWE-359

SpotBugs All (17)

CWE-15, CWE-106, CWE-158, CWE-172, CWE-176, CWE-179, CWE-180, CWE-212, CWE-228, CWE-233, CWE-235, CWE-321, CWE-353, CWE-359, CWE-539, CWE-696, CWE-1173

Semgrep All (2)

CWE-150, CWE-323

Insider All (1)

CWE-250

CodeQL — Tool-Only Top CWEs (6)

CWE-23, CWE-203, CWE-209, CWE-435, CWE-436, CWE-755

CodeQL — Tool-Only CWEs (36)

CWE-23, CWE-36, CWE-88, CWE-90, CWE-99, CWE-113, CWE-172, CWE-176, CWE-179, CWE-180, CWE-185, CWE-186, CWE-203, CWE-208, CWE-209, CWE-215, CWE-252, CWE-321, CWE-340, CWE-348, CWE-359, CWE-390, CWE-396, CWE-404, CWE-435, CWE-436, CWE-497, CWE-570, CWE-571, CWE-581, CWE-643, CWE-685, CWE-687, CWE-696, CWE-755, CWE-772

Semgrep — Tool-Only Top CWEs (4)

CWE-138, CWE-276, CWE-306, CWE-862

Semgrep — Tool-Only CWEs (15)

CWE-96, CWE-134, CWE-138, CWE-155, CWE-250, CWE-276, CWE-306, CWE-322, CWE-552, CWE-553, CWE-673, CWE-704, CWE-862, CWE-915, CWE-939

SonarQube All (13)

CWE-256, CWE-266, CWE-297, CWE-379, CWE-394, CWE-397, CWE-470, CWE-480, CWE-482, CWE-759, CWE-760, CWE-780, CWE-1241

Bandit — Tool-Only Top CWEs (2)

CWE-80, CWE-666

Bandit — Tool-Only CWEs (6)

CWE-80, CWE-494, CWE-605, CWE-666, CWE-675, CWE-838

Finding 5: The covered Top_Lan CWE sets vary substantially across tools. CodeQL achieves the highest coverage across all languages (≈3.6× the lowest-performing tool). No single tool covers all CWEs — practitioners should combine tools based on target CWE categories.

Checker Migration Across Languages

For top CWEs shared across languages, can existing checkers be migrated to other languages?

CodeQL — Missing & Migratable

Semgrep — Missing & Migratable

Migration Feasibility — Fine-Grained Classification

CodeQL

Language	Direct Rule	Query-only	Semantically Non-Migr.	Prohibitive Lib
C/C++	21	15	7	9
Java	1	1	14	3
Python	0	0	8	5

Semgrep

Language	Direct Rule	Query-only	Semantically Non-Migr.	Prohibitive Lib
C/C++	39	43	8	2
Java	1	1	0	0
Python	0	1	0	0

Checker Migration Details

Per-checker migration feasibility across languages — grouped by tool and source language

DR — Direct Rule Migration : denotes rule reuse without synonymous structural substitution — i.e., rule-level migration.

QO — Query-only Migration : requires only rewriting queries without expanding libraries — i.e., checker-level migration.

Migratable 0 Semantically Non-Migr. 0 Prohibitive Lib 0

Finding 6: About 75% of checkers can be migrated. C/C++ has the most migratable checkers. Semgrep (92.5% migration rate) shows higher transferability than CodeQL (47.7%), suggesting pattern-based checkers are easier to migrate than semantically complex ones.

Comparison with Related Studies

How this study compares with prior empirical evaluations of SAST tools

Lang	Paper Title	Tools Evaluated	Covered CWEs	Dataset	F1 Score	Detection Rate
C/C++	CASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs Towards CWE Detection	CodeQL, Semgrep, Cppcheck, CSA	25	250 handmake c test	codeql 0.36, semgrep 0.27, cppcheck 0.22, CSA 0.16
	An empirical study on the effectiveness of static C code analyzers for vulnerability detection	flawfinder, cppcheck, codeql	21	192 Real world bug		flawfinder: 9%, codeql 13%, cppcheck 1%
	An Empirical Study of Static Analysis Tools for Secure Code Review	codeql, cppcheck, flawfinder	8 root CWE	815 Real world bug		codeql 8%, flawfinder 31%, cppcheck 1%
	Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools	codeql, semgrep, CSA	12	juliet	codeql 0.57, semgrep 0.36, CSA 0.12
Java	Comprehensive Evaluation of Static Analysis Tools for Their Performance in Finding Vulnerabilities in Java Code	sonarqube, spotbugs	sonarqube 32, spotbugs 24	juliet		sonarqube 63%, spotbugs 92%
Java	Comparison and Evaluation on Static Application Security Testing (SAST) Tools for Java	codeql, insider, semgrep, sonarqube, spotbugs	OWASP 11, Real World 37	2740 OWASP benchmark + 165 real world bug	OWASP: codeql 0.49, insider 0.14, semgrep 0.80, sonarqube 0.27, spotbug 0.83	Real world: codeql 6.67%, insider 2.42%, semgrep 5.45%, sonarqube 5.45%, spotbugs 10.30%
Python	An Empirical Study of Vulnerabilities in Python Packages and Their Detection	codeql, bandit	6	244 real world bug		codeql 10.85%, Bandit 5.29%
Python	Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection	bandit, semgrep, codeql	7	98 real world bug		bandit 20%, codeql 1%, semgrep 9%

Key Differences from Prior Work

Larger Scale

197,016 CVEs analyzed across 10 years, covering 944 CWE types — significantly larger than prior studies that focused on limited benchmarks (Juliet, OWASP).

Language-Specific Rankings

First study to construct systematic Top_Lan CWE lists for C/C++, Java, and Python, rather than relying on general CWE Top 25.

Comprehensive Tool Coverage

Evaluates 9 tools across 3 languages at the CWE coverage level, including checker migration analysis across languages.

Root Cause Analysis

Manual classification of uncovered CWEs into 4 categories, explaining fundamental limitations of static analysis techniques.

Mind the Gap: Do Widely-used SAST Tools Really Cover the Language-Specific Top CWEs?

Language-Specific Distribution of Top CWEs

CVE Trends (2016–2025)

C/C++

Java

Python

Root CWE Distribution by Language

Language-Specific vs. General CWE Top 25

Jaccard Similarity set-level overlap

RBO (q=0.9) rank-aware similarity

Top 25 CWE Lists — Side by Side

TopC/C++ 25

TopC/C++ 25 (CVSS)

TopJava 25

TopJava 25 (CVSS)

TopPython 25

TopPython 25 (CVSS)

Cross-Comparison Similarity Matrix

Top CWE Coverage Gaps in SAST Tools

Overall Coverage

C/C++

Java

Python

Coverage by Root CWE Category per Language

Uncovered High-Frequency CWEs — Detailed View

C/C++ Missed (65)

Java Missed (17)

Python Missed (9)

Why Are These CWEs Uncovered?

Reason Breakdown by Language

Classification Categories

Uncovered CWE Reason Counts

Uncovered CWEs with Reason Classification

CWE Coverage Variation Across SAST Tools

Coverage by Tool per Language

Top CWE Coverage by Tool

Tool Coverage Details

Tool-Only CWE Details

CodeQL — Tool-Only Top CWEs (45)

CodeQL — Tool-Only CWEs (77)

Cppcheck — Tool-Only Top CWEs (2)

Cppcheck — Tool-Only CWEs (8)

Semgrep Top (2)

Semgrep All (3)

CSA Top (1)

CSA All (5)

Flawfinder — Tool-Only Top CWEs (3)

Flawfinder — Tool-Only CWEs (4)

CodeQL — Tool-Only Top CWEs (12)

CodeQL — Tool-Only CWEs (71)

SonarQube — Tool-Only Top CWEs (4)

SonarQube — Tool-Only CWEs (27)

SpotBugs Top (1)

SpotBugs All (17)

Semgrep All (2)

Insider All (1)

CodeQL — Tool-Only Top CWEs (6)

CodeQL — Tool-Only CWEs (36)

Semgrep — Tool-Only Top CWEs (4)

Semgrep — Tool-Only CWEs (15)

SonarQube All (13)

Bandit — Tool-Only Top CWEs (2)

Bandit — Tool-Only CWEs (6)

Checker Migration Across Languages

CodeQL — Missing & Migratable

Semgrep — Missing & Migratable

Migration Feasibility — Fine-Grained Classification

CodeQL

Semgrep

Checker Migration Details

Comparison with Related Studies

Key Differences from Prior Work

Top_C/C++ 25

Top_C/C++ 25 (CVSS)

Top_Java 25

Top_Java 25 (CVSS)

Top_Python 25

Top_Python 25 (CVSS)