It has messy stdlib (gets()!) and lots of features that you can shoot yourself in the foot with (software security would look very different if it had arrays like D).

The C standard library is very clean. gets is left in the C89 and C99 standards for backward compatibility an deprecated right now. Nobody uses gets nowadays.