CISA: MOST CRITICAL OPEN SOURCE PROJECTS NOT USING MEMORY SAFE CODE

Summary from the TLDR InfoSec newsletter

A report from CISA examined 172 broadly deployed open source projects. Some key findings include that 52% of the analyzed projects contain code written in memory unsafe languages, 55% of the total lines of code across all projects were written in memory unsafe languages, and that the median proportion of lines of code written in memory unsafe languages across the ten largest projects was 62.5% with four projects exceeding 94%. CISA notes that some of these projects are designed with critical performance and resource constraints where memory unsafe languages will likely remain prevalent.