Security
Study reveals exploit effectiveness across Java library versions, discovers 796 missing vulnerabilities
Researchers test whether security exploits written for one version of a Java library actually work on other versions—and find they're surprisingly reliable at pinpointing vulnerable code.
A new empirical study challenges the conventional wisdom that software exploits are locked to specific library versions. Researchers constructed a large-scale dataset of 259 exploits spanning 128 Java libraries and over 28,000 historical versions to test whether vulnerability exploits could reliably identify affected versions across the full version history of a library.
What the research found#
The core finding is striking: without any adaptation or modification, the tested exploits achieved 83.0% recall and 99.3% precision in correctly identifying which library versions were vulnerable. This means the exploits caught most true vulnerabilities while producing very few false positives—performance that exceeds what most mainstream vulnerability databases and assessment tools deliver today.
This capability allowed the researchers to identify and contribute 796 previously undocumented vulnerable versions to the CPE (Common Platform Enumeration) dictionary, filling gaps in the widely used vulnerability registry.
Why exploits fail across versions#
The research also scrutinized the remaining cases where exploits did not work as expected. Failures typically stemmed from two sources: compatibility issues introduced as libraries evolved and shifts in the runtime or environmental constraints that the exploit depends on. These barriers explained why the straightforward approach sometimes fell short.
Path to improvement#
The team manually adapted exploits for 1,885 additional versions, distilling a taxonomy of 10 distinct strategies for updating exploits to work across library versions. By applying these migration techniques, they lifted overall recall to 96.1%, demonstrating that thoughtful adaptation can close most of the remaining gap.
The study analyzed exploits covering 61 different weakness categories (CWEs) that represent 76.33% of all vulnerabilities found in the Maven central repository, making the findings broadly representative of real-world Java security challenges. This large-scale validation of exploit applicability—available as a preprint on arXiv—offers both a richer understanding of how exploit portability works and a clearer blueprint for improving automated vulnerability detection at scale.
