arXiv preprint ·
A Fine-Grained Empirical Study of Upstream Security Events and Downstream Mitigation in Maven
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
Open-source vulnerability mitigation spans upstream libraries and the downstream projects that depend on them. Upstream, a vulnerability progresses through a public report when one exists, a fix, a fixed release, and NVD disclosure. Downstream, a project mitigates it by adopting the fixed release, and the timeliness of this adoption is measured relative to these events. Prior work studies the two sides separately, so it is unclear whether downstream exposure stems from delayed upstream release, delayed downstream adoption, or both. We address this gap by following 832 CVEs in the Maven ecosystem from the upstream fix to its adoption by each exposed downstream project. We classify upstream fixes as \textit{silent} or \textit{transparent}, recover the order of report, fix, release, and NVD disclosure, and link vulnerable artifacts to their downstream dependents. We then compare this order with downstream adoption and dependabot usage. We find that delay arises on both sides. Upstream, the fixed release comes before NVD disclosure for about 82\% of CVEs, for both silent and transparent fixes. For the other 17.9\%, downstream projects have no fix to adopt for days to more than four months after disclosure. Downstream, exposure is concentrated, with the top 10\% of CVEs accounting for 72.1\% of it. Of 1,677 observed adoptions, 85.3\% happen after NVD disclosure, rising to 88.3\% for silent fixes released before disclosure. Most adoptions come through routine dependency updates. Adoptions with dependabot version updates have a median release-to-adoption delay of 10.4 days, compared with 110.6 days without dependabot. Yet version updates were configured at adoption time for only 8.5\% of total adoptions. We translate these findings into implications for upstream maintainers, downstream developers, and dependency-automation tools.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Software Engineering
ProCerDCL: Query-Efficient Black-Box Probabilistic Verification of Deep Learning Compiler Optimization
Template-Free Dynamic Invariant Detection
From Ripple to Boundary: Deterministic Impact Boundaries for LLM-Based Software Evolution
Mentorship, Interrupted: How GenAI Disrupts the GSoC Pipeline and Why Mentors Matter More
CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents
Get the few papers worth your time in Software Engineering every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.