View PDF HTML (experimental)

Abstract:An upstream task for vulnerability management is the accurate localization of the patch that fixes a vulnerability. Existing works have proposed several approaches to trace or retrieve the patching commit for fixing a CVE. However, they suffer from two major challenges: (1) they cannot effectively handle the long diff code in patch commits, which is common when commit messages are non-informative; and (2) they do not scale to the full repository with satisfactory accuracy in realistic settings.
We propose SPFinder, a scalable and effective retrieval framework for tracing known vulnerability patches. To address the long-context challenge, SPFinder introduces a hierarchical embedding technique that efficiently extends context coverage while mitigating long-context degradation, enabling effective modeling of all files in the commit. To address the scalability challenge, SPFinder adopts a three-phase retrieval framework that balances effectiveness and efficiency, achieving high recall at the full-repository level.
Our evaluation on two datasets shows that SPFinder outperforms state-of-the-art patch tracing methods, including PatchFinder, PatchScout, and VFCFinder, by a large margin, and surpasses VoyageAI, a leading commercial code embedding model, on MRR and Recall@10 by 18% and 28%, respectively. Using SPFinder, we successfully traced and merged patch links for 35 CVEs in the GitHub Advisory Database, demonstrating its practical applicability. An ablation study further confirms that hierarchical embedding is a practically effective solution for handling long context in patch retrieval. Our artifacts and online demo are publicly available at this https URL and this http URL.

Submission history

From: Xueqing Liu [view email]
[v1] Sat, 29 Mar 2025 01:53:07 UTC (1,443 KB)
[v2] Sat, 31 May 2025 19:45:52 UTC (2,379 KB)
[v3] Fri, 15 Aug 2025 00:39:16 UTC (2,379 KB)
[v4] Sat, 1 Aug 2026 22:15:40 UTC (1,500 KB)