一句话：首次大规模实证研究多补丁漏洞，构建数据集与分类法，并开发 SPectre 提升补丁发现覆盖。
安全补丁通常用于修复漏洞，但一个漏洞未必由一个补丁解决：可能增量修复、跨维护分支传播或跨相关仓库复制；补丁记录不完整会使下游只应用部分修复。本文首次大规模实证研究多补丁漏洞。作者合并四个主要漏洞数据库，构建含6,053个多补丁CVE、16,260个补丁的数据集，发现20.6%的有补丁CVE涉及多个补丁，合并数据库使识别数较单一来源提高36–55%。作者归纳成因，提出6类16子类的两级分类法，并据此开发补丁发现原型SPectre。在300个多补丁CVE上，同仓库与跨仓库案例分别达到0.927和0.873召回；在100个公共库均记录为单补丁的近期CVE中，额外发现20个CVE的28个未报告补丁。结果表明多补丁漏洞普遍且被系统性低报。
Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling.
@inproceedings{paperbot12397,
title = {One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability},
author = {Fangyuan Zhang and Lyuye Zhang and Lingling Fan and Chengwei Liu and Yinan Li and Liang Huang and Yang Liu and Zheli Liu and Sen Chen},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837455}
}