# Tracking Patches for Open Source Software Vulnerabilities

arXiv: https://arxiv.org/abs/2112.02240 · HTML: https://mlsanity.com/paper/2112.02240/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Dec 2021.

## Built on by (most cited first, 2 of 2)

- [PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software](https://mlsanity.com/paper/2407.17065/) (2024)
- [PyResBugs: A Dataset of Residual Python Bugs for Natural Language-Driven Fault Injection](https://mlsanity.com/paper/2505.05777/) (2025)

## Abstract (arXiv)

Open source software (OSS) vulnerabilities threaten the security of software systems that use OSS. Vulnerability databases provide valuable information (e.g., vulnerable version and patch) to mitigate OSS vulnerabilities. There arises a growing concern about the information quality of vulnerability databases. However, it is unclear what the quality of patches in existing vulnerability databases is; and existing manual or heuristic-based approaches for patch tracking are either too expensive or too specific to apply to all OSS vulnerabilities.