flawfinder – find potential security flaws in C and C++ code

Flawfinder is a static analysis tool that examines C and C++ source code for potential security vulnerabilities. It uses lexical analysis to identify suspicious function calls and programming constructs associated with common software weaknesses.

Unlike more complex static analysers, Flawfinder does not need to compile the program or construct a detailed model of its behaviour. This makes it useful for examining incomplete projects, unfamiliar codebases and applications that cannot readily be built.

The analyser assigns risk levels to its findings, helping developers prioritise areas requiring closer inspection. Its results are indicators of possible vulnerabilities rather than confirmation that an exploitable weakness exists. Because lexical analysis cannot fully understand program control flow or data flow, some findings will be false positives and other vulnerabilities may go undetected.

Flawfinder provides several reporting formats and facilities for comparing findings across scans. These make it suitable for automated security checks as well as manual source code reviews.

This is free and open source software.

Key Features

• Scans individual C and C++ files or recursively examines source code directories.
• Identifies potentially dangerous functions and programming constructs using a built-in ruleset.
• Assigns risk levels from 0 to 5 and sorts findings by estimated severity.
• Supports Common Weakness Enumeration (CWE) identifiers for classifying potential vulnerabilities.
• Displays source locations, risk information and explanations of suspicious constructs.
• Optional source context and column numbers provide additional information about findings.
• Filters results by minimum risk level, regular expressions and excluded paths.
• Supports source comments for suppressing known false positives, with an option to override suppression.
• Can identify functions that accept external input for additional security review.
• Generates plain text, HTML, CSV, SARIF and SonarQube-compatible reports.
• Saves and reloads hit lists, with differential comparisons to identify new findings.
• Supports analysing changed source lines identified by unified diff files.
• Configurable error exit codes allow security thresholds to be enforced in CI workflows.
• Provides GitHub Actions integration and support for SonarQube’s C/C++ plugin.
• Cross-platform support – runs on Linux and macOS.

Website: github.com/david-a-wheeler/flawfinder
Support:
Developer: David A. Wheeler
License: GNU General Public License v2.0

flawfinder is written in Python. Learn Python with our recommended free books and free tutorials.

Related Software

Read our verdict in the software roundup.

LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software. We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README.