Why Not Fix It Once and for All? An Empirical Study of Multiple Patches for Vulnerability Fixes in Open-Source Software

• URL: http://arxiv.org/abs/2607.13206v1
• Date: Tue, 14 Jul 2026 18:57:43 GMT
• Title: Why Not Fix It Once and for All? An Empirical Study of Multiple Patches for Vulnerability Fixes in Open-Source Software
• Abstract summary: This paper presents a systematic analysis of multi-patch vulnerability fixes.<n>We focus on their root causes, characteristics, and methods for verifying remediation status.<n>Our findings provide new insights into multi-patch fixes and lay a foundation for future research in this field.
• Score: 0.28314082493466963
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Security patches for open-source software constitute a foundational resource for vulnerability remediation research and practice. However, analyzing and applying multiple patches remains challenging, especially when trying to determine at what point in a patch sequence a vulnerability is fully remediated. This paper presents a systematic analysis of multi-patch vulnerability fixes, focusing on their root causes, characteristics, and methods for verifying remediation status throughout the fixing process. Through a manual examination of 1,646 multi-patch fix records, we develop a taxonomy with three primary categories and six subcategories based on their causes. We then compare the distinctive characteristics of multi-patch fixes with those of single-patch fixes and analyze feature variations across categories. In addition, we assess representative vulnerability detection methods for validating complete remediation during multi-patch fixing. Our findings provide new insights into multi-patch fixes and lay a foundation for future research in this field.

Related papers

• One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability [26.584464444465212]
  We present the first large-scale empirical study of multi-SP vulnerabilities.<n>By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs.<n>We develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery.
  arXiv  Detail & Related papers  (2026-09-07T08:38:18Z)
• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• PhoenixRepair: Rethinking Repair Strategy Exploration in Software Agents [62.36339598951133]
  We present PhoenixRepair, a multi-agent framework that explores multiple candidate edit locations and generates better patches.<n>PhoenixRepair achieves the largest relative improvement of 7.8% over SWE-agent under DeepSeek-V3.1, and attains the highest resolved rate of 76.0% Pass@1 under MiniMax-M2.5.
  arXiv  Detail & Related papers  (2026-07-21T08:49:30Z)
• Knowledge-Enhanced Agentic Vulnerability Repair [20.715227299482947]
  KeaRepair is a novel agentic approach that grounds patch generation in verified program facts and high-level vulnerability knowledge.<n>It significantly outperforms existing approaches on 55 C/C++ vulnerabilities.<n>When paired with Gemini-3.1-Pro, KeaRepair successfully repairs 46 vulnerabilities, achieving a repair rate of 83.64%.
  arXiv  Detail & Related papers  (2026-07-01T11:42:25Z)
• TIDE: Proactive Multi-Problem Discovery via Template-Guided Iteration [74.97459526627395]
  We introduce TIDE, a template-guided iterative framework with two complementary mechanisms.<n>We propose iterative discovery, which surfaces a small batch of candidates per round while conditioning on what has already been found.<n>We show substantial gains over single-shot and parallel multi-agent baselines on task coverage, identification, and resolution.
  arXiv  Detail & Related papers  (2026-06-03T11:23:08Z)
• Demystifying deep search: a holistic evaluation with hint-free multi-hop questions and factorised metrics [89.1999907891494]
  We present WebDetective, a benchmark of hint-free multi-hop questions paired with a controlled Wikipedia sandbox.<n>Our evaluation of 25 state-of-the-art models reveals systematic weaknesses across all architectures.<n>We develop an agentic workflow, EvidenceLoop, that explicitly targets the challenges our benchmark identifies.
  arXiv  Detail & Related papers  (2025-10-01T07:59:03Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• All Patches Matter, More Patches Better: Enhance AI-Generated Image Detection via Panoptic Patch Learning [45.37237171823581]
  The exponential growth of AI-generated images (AIGIs) underscores the urgent need for robust and generalizable detection methods.<n>In this paper, we establish two key principles for AIGI detection through systematic analysis.
  arXiv  Detail & Related papers  (2025-04-02T06:32:09Z)
• Fixseeker: An Empirical Driven Graph-based Approach for Detecting Silent Vulnerability Fixes in Open Source Software [12.706661324384319]
  Open source software vulnerabilities pose significant security risks to downstream applications.<n>Many security patches are released silently in new commits of OSS repositories without explicit indications of their security impact.<n>We propose Fixseeker, a graph-based approach that extracts the various correlations between code changes at the hunk level to detect silent vulnerability fixes.
  arXiv  Detail & Related papers  (2025-03-26T06:16:58Z)
• Patch2QL: Discover Cognate Defects in Open Source Software Supply Chain With Auto-generated Static Analysis Rules [1.9591497166224197]
  We propose a novel technique for detecting cognate defects in OSS through the automatic generation of SAST rules. Specifically, it extracts key syntax and semantic information from pre- and post-patch versions of code. We have implemented a prototype tool called Patch2QL and applied it to fundamental OSS in C/C++.
  arXiv  Detail & Related papers  (2024-01-23T02:23:11Z)
• Patch Space Exploration using Static Analysis Feedback [8.13782364161157]
  We show how to automatically repair memory safety issues, by leveraging static analysis to guide repair. Our proposed approach learns what a desirable patch is by inspecting how close a patch is to fixing the bug. We make repair scalable by creating classes of equivalent patches according to the effect they have on the symbolic heap, and then invoking the validation oracle only once per class of patch equivalence.
  arXiv  Detail & Related papers  (2023-08-01T05:22:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.