Why Not Fix It Once and for All? An Empirical Study of Multiple Patches for Vulnerability Fixes in Open-Source Software

arXiv:2607.13206 · cs.CR, cs.SE · Submitted 2026-07-14 · Read on arXiv

Weiliang Qi, Youpeng Li, Xinda Wang

cs.CR, cs.SE

Submitted: 2026-07-14

Comments: Accepted at ESORICS 2026

Code: https://github.com/CVEProject/cvedocuments

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

International Conference on Software Engineering — 5× in this paper
Benchmark — 3× in this paper · explained in 2 episodes
IEEE Symposium on Security and Privacy — 3× in this paper
Accuracy — 2× in this paper · explained in 1 episode
Common Vulnerabilities and Exposures — 2× in this paper
International Conference on Mining Software Repositories — 2× in this paper
Transformer — 2× in this paper · explained in 2 episodes
Actor — 1× in this paper · explained in 3 episodes
Core — 1× in this paper · explained in 2 episodes
F1 Score — 1× in this paper · explained in 3 episodes
Information Leakage — 1× in this paper · explained in 2 episodes
National Science Foundation — 1× in this paper
National Vulnerability Database — 1× in this paper
Two-Phase Framework — 1× in this paper · explained in 2 episodes

Sources

Related papers