Insights into Vulnerability Trends in Maven Artifacts: Recurrence, Popularity, and User Behavior
Courtney Bodily, Eric Hill, Alfred Kramer, Leslie Kerby, Minhaz F. Zibran · 2025
Vulnerabilities in open-source software, particularly in ecosystems like Maven Central, propagate risks across projects. This paper examines vulnerability trends in Maven artifacts, focusing on recurrence patterns, user behavior after disclosures, and the link between popularity and exposure. Analyzing 24 vulnerable artifacts and $2,900+$ releases, we find recurring risks in previously vulnerable artifacts, significant intravs. extra-organizational differences in user behavior, and minimal correlation between popularity and vulnerability exposure. These results underscore the need for proactive security, effective disclosures, and better dependency management to strengthen ecosystem resilience.