CWE-1104: Use of Unmaintained Third-Party Components
A weakness from depending on a third-party component that is no longer actively maintained or supported.
Why It Matters
An unmaintained component doesn't need a currently-known CVE to be a risk — the risk is that a future vulnerability in it will never be patched, because no one is maintaining a fix.
Application to Application Security
Underlies OWASP Mobile M2 (Inadequate Supply Chain Security) — a mobile app that bundles an abandoned analytics SDK or a stale native library inherits this risk even before any specific CVE is disclosed against it.
Relation to Software Development
Dependencies are added for a feature they provide at the time; maintenance status is rarely re-evaluated afterward unless a specific incident prompts a review.
How Strata Surfaces This
Version comparison against known-vulnerable ranges via the OSV database, combined with dependency metadata that can indicate a component's release cadence has stopped.
Developer guidance
Check a dependency's maintenance activity (recent releases, open issue response time) before adopting it, and periodically re-evaluate long-lived dependencies the same way.
Management guidance
A dependency review cadence is the practical mitigation here — this weakness class rewards a standing process more than a one-time audit.