Chasing the Clock: How Fast Are Vulnerabilities Fixed in the Maven Ecosystem?
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866915218561433600 |
|---|---|
| author | Rabbi, Md Fazle Champa, Arifa Islam Paul, Rajshakhar Zibran, Minhaz F. |
| author_facet | Rabbi, Md Fazle Champa, Arifa Islam Paul, Rajshakhar Zibran, Minhaz F. |
| contents | This study investigates the software vulnerability resolution time in the Maven ecosystem, focusing on the influence of CVE severity, library popularity as measured by the number of dependents, and version release frequency. The results suggest that critical vulnerabilities are addressed slightly faster compared to lower-severity ones. Library popularity shows a positive impact on resolution times, while frequent version updates are associated with faster vulnerability fixes. These statistically significant findings are based on a thorough evaluation of over 14 million versions from 658,078 libraries using the dependency graph database of Goblin framework. These results emphasize the need for proactive maintenance strategies to improve vulnerability management in open-source ecosystems. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2503_22894 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Chasing the Clock: How Fast Are Vulnerabilities Fixed in the Maven Ecosystem? Rabbi, Md Fazle Champa, Arifa Islam Paul, Rajshakhar Zibran, Minhaz F. Software Engineering This study investigates the software vulnerability resolution time in the Maven ecosystem, focusing on the influence of CVE severity, library popularity as measured by the number of dependents, and version release frequency. The results suggest that critical vulnerabilities are addressed slightly faster compared to lower-severity ones. Library popularity shows a positive impact on resolution times, while frequent version updates are associated with faster vulnerability fixes. These statistically significant findings are based on a thorough evaluation of over 14 million versions from 658,078 libraries using the dependency graph database of Goblin framework. These results emphasize the need for proactive maintenance strategies to improve vulnerability management in open-source ecosystems. |
| title | Chasing the Clock: How Fast Are Vulnerabilities Fixed in the Maven Ecosystem? |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2503.22894 |