Many Tools, Few Exploitable Vulnerabilities: A Survey of 246 Static Code Analyzers for Security
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866912915731251200 |
|---|---|
| author | Hermann, Kevin Peldszus, Sven Berger, Thorsten |
| author_facet | Hermann, Kevin Peldszus, Sven Berger, Thorsten |
| contents | Static security analysis is a widely used technique for detecting software vulnerabilities across a wide range of weaknesses, application domains, and programming languages. While prior work surveyed static analyzes for specific weaknesses or application domains, no overview of the entire security landscape exists. We present a systematic literature review of 246 static security analyzers concerning their targeted vulnerabilities, application domains, analysis techniques, evaluation methods, and limitations. We observe that most analyzers focus on a limited set of weaknesses, that the vulnerabilities they detect are rarely exploitable, and that evaluations use custom benchmarks that are too small to enable robust assessment. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_18270 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Many Tools, Few Exploitable Vulnerabilities: A Survey of 246 Static Code Analyzers for Security Hermann, Kevin Peldszus, Sven Berger, Thorsten Cryptography and Security Software Engineering Static security analysis is a widely used technique for detecting software vulnerabilities across a wide range of weaknesses, application domains, and programming languages. While prior work surveyed static analyzes for specific weaknesses or application domains, no overview of the entire security landscape exists. We present a systematic literature review of 246 static security analyzers concerning their targeted vulnerabilities, application domains, analysis techniques, evaluation methods, and limitations. We observe that most analyzers focus on a limited set of weaknesses, that the vulnerabilities they detect are rarely exploitable, and that evaluations use custom benchmarks that are too small to enable robust assessment. |
| title | Many Tools, Few Exploitable Vulnerabilities: A Survey of 246 Static Code Analyzers for Security |
| topic | Cryptography and Security Software Engineering |
| url | https://arxiv.org/abs/2602.18270 |