A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits

A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits | Signal Canvas | ScienceToStartup

Page Freshness

Signal Canvas proof surface

Canonical route: /signal-canvas/a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits

stale

Proof freshness: stale
Proof status: unverified
Display score: 7/10
Last proof check: 2026-03-30
Score updated: 2026-04-02
Score fresh until: 2026-05-02
References: 71
Source count: 3
Coverage: 50%

This page is showing the last landed evidence receipt and score bundle because the latest proof data is outside the freshness window.

Agent Handoff

Canonical ID a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits | Route /signal-canvas/a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits

REST example

curl https://sciencetostartup.com/api/v1/agent-handoff/signal-canvas/a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits

MCP example

{
  "tool": "search_signal_canvas",
  "arguments": {
    "mode": "paper",
    "paper_ref": "a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits",
    "query_text": "Summarize A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits"
  }
}

source_context

{
  "surface": "signal_canvas",
  "mode": "paper",
  "query": "A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits",
  "normalized_query": "2603.25997",
  "route": "/signal-canvas/a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits",
  "paper_ref": "a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits",
  "topic_slug": null,
  "benchmark_ref": null,
  "dataset_ref": null
}

Evidence Receipt

Route status: building

Claims: 12

References: 71

Proof: Verification pending

Freshness state: computing

Source paper: A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits

PDF: https://arxiv.org/pdf/2603.25997v1

Source count: 3

Coverage: 50%

Last proof check: 2026-03-30T21:55:46.135Z

Signal Canvas receipt window

Watch and verify: A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits

/buildability/a-large-scale-empirical-study-on-the-generalizability-of-disclosed-java-library-vulnerability-exploits

Watchwatch

Subject: A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits

Verdict

Watch

Verdict is Watch because viability or proof quality is intermediate and should be re-evaluated before execution.

Preparing verified analysis

GitHub Code Pulse

No public code linked for this paper yet.

Claim map

Strong 12Mixed 0Weak 0

Evidencepartial
Our results (RQ1) show that, even without migration, exploits achieve 83.0% recall and 99.3% precision in identifying affected versions in Java, outperforming most widely used vulnerability databases and assessment tools.
Implicationpartial
This is a direct result stated in the abstract and supported by the analysis of RQ1.
Verificationpartial
partial
Evidencepartial
We construct a comprehensive dataset consisting of 259 exploits spanning 128 Java libraries and 28,150 historical versions, covering 61 CWEs that account for 76.33% of vulnerabilities in Maven.
Implicationpartial
This is a key contribution and dataset size explicitly stated in the abstract and contributions section.
Verificationpartial
partial
Evidencepartial
We investigate the remaining exploit failures (RQ2) and find that they mainly stem from compatibility issues introduced by library evolution and changing environmental constraints.
Implicationpartial
This is a direct finding from the analysis of RQ2, as stated in the abstract.
Verificationpartial
partial
Evidencepartial
Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%.
Implicationpartial
This is a direct result of the exploit migration effort (RQ3) stated in the abstract.
Verificationpartial
partial
Evidencepartial
Notably, this capability enables us to contribute 796 confirmed missing affected versions to the CPE dictionary.
Implicationpartial
This is a direct outcome of the exploit applicability analysis, as stated in the abstract.
Verificationpartial
partial
Evidencepartial
Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%.
Implicationpartial
This is a direct outcome of the exploit migration analysis (RQ3) stated in the abstract.
Verificationpartial
partial
Evidencepartial
Our dataset encompasses vulnerabilities affecting 128 libraries across 41 categories, ranging from testing frameworks and logging tools to JVM languages, HTTP clients, XML processors, and Object Serialization libraries.
Implicationpartial
This detail about the dataset composition is explicitly mentioned in the 'Library Categories' section.
Verificationpartial
partial
Evidencepartial
Our results (RQ1) show that, even without migration, exploits achieve 83.0% recall and 99.3% precision in identifying affected versions in Java, outperforming most widely used vulnerability databases and assessment tools.
Implicationpartial
This is a direct result stated in the abstract and supported by the analysis of RQ1.
Verificationpartial
partial
Evidencepartial
We construct a comprehensive dataset consisting of 259 exploits spanning 128 Java libraries and 28,150 historical versions, covering 61 CWEs that account for 76.33% of vulnerabilities in Maven.
Implicationpartial
This is a key contribution and dataset size explicitly mentioned in the abstract and contributions section.
Verificationpartial
partial
Evidencepartial
We investigate the remaining exploit failures (RQ2) and find that they mainly stem from compatibility issues introduced by library evolution and changing environmental constraints.
Implicationpartial
This is a direct finding from the analysis of RQ2, as stated in the abstract.
Verificationpartial
partial
Evidencepartial
Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%.
Implicationpartial
This is a direct result quantifying the impact of exploit migration, as stated in the abstract and conclusion.
Verificationpartial
partial
Evidencepartial
Notably, this capability enables us to contribute 796 confirmed missing affected versions to the CPE dictionary.
Implicationpartial
This is a specific, verifiable outcome of the study's findings, mentioned as a contribution.
Verificationpartial
partial

Author intelligence and commercialization panels stay hidden until the proof receipt is verified, cites at least 3 references, includes at least 2 sources, and clears 50% coverage. The paper narrative and citation surfaces remain public while verification is pending.

A Large-scale Empirical Study on the Generalizability of Disclosed Java Library Vulnerability Exploits

Use Signal Canvas as the narrative proof surface

Use this Signal Canvas via API or MCP

Signal Canvas proof surface