一句话：首个大规模实证研究，表明 Java 库漏洞 exploit 跨版本识别受影响版本有效，并归纳迁移策略。
开源软件供应链安全依赖准确判定库漏洞的受影响版本。已有研究利用 exploit 验证受影响版本，但普遍认为 exploit 版本特定、难以跨版本使用，且该限制未被大规模验证。本文构建覆盖 259 个 exploit、128 个 Java 库、28,150 个历史版本和 61 个 CWE（占 Maven 漏洞 76.3%）的数据集，开展首个大规模实证研究。结果显示，即使不迁移，exploit 识别受影响版本仍达 83.0% 召回率和 99.3% 精度，优于常用漏洞库与工具，并向 CPE 字典贡献 1400 多个缺失受影响版本。剩余失败主要源于库演化兼容性与环境约束变化；作者手工迁移 1,885 个版本，归纳 10 类策略，将召回率提升至 96.1%。
Open-source software supply chain security relies heavily on assessing affected versions of library vulnerabilities. While prior studies have leveraged exploits for verifying vulnerability-affected versions, they point out a key limitation that exploits are version-specific and cannot be directly applied across library versions. Despite being widely acknowledged, this limitation has not been systematically validated at scale, leaving the actual applicability of exploits across versions unexplored. To fill this gap, we conduct the first large-scale empirical study on exploit applicability across library versions. We construct a comprehensive dataset consisting of 259 exploits spanning 128 Java libraries and 28,150 historical versions, covering 61 CWEs that account for 76.3% of vulnerabilities in Maven. Leveraging this dataset, we investigate the root causes of inconsistencies between exploit cross-version execution behaviors and ground truth, while also exploring strategies for exploit migration. Our results (RQ1) show that, even without migration, exploits achieve 83.0% recall and 99.3% precision in identifying affected versions in Java, outperforming most widely used vulnerability databases and assessment tools. Notably, this capability enables us to contribute more than 1,400 confirmed missing affected versions to the CPE dictionary. We investigate the remaining exploit failures (RQ2) and find that they mainly stem from compatibility issues introduced by library evolution and changing environmental constraints. Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%. Our findings underscore the cross-version potential of exploits and lay a foundation for future research.
@inproceedings{paperbot12433,
title = {Assessing the Cross-Version Applicability of Java Library Vulnerability Exploits},
author = {Zirui Chen and Qi Zhan and Jiayuan Zhou and Xing Hu and Xin Xia and Xiaohu Yang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834383}
}