Where Is the Fix? A Cross-Ecosystem Census of Machine-Actionable Remediation Endpoints in OSV
Keywords:
OSV, vulnerability remediation, affected versions, open-source security, vulnerability databases, package ecosystemsAbstract
Background: Open Source Vulnerability (OSV) records can describe affected versions with `fixed`, `last_affected`, `limit`, and enumerated-version representations. Only an explicit `fixed` event directly identifies a version that contains a fix.
Objective: We measured the availability and concentration of remediation endpoints across six package ecosystems in an OSV snapshot.
Methods: Archives for PyPI, npm, Maven, Go, crates.io, and RubyGems were frozen by SHA-256. A protocol-locked, test-driven pipeline deduplicated records and classified package entries, ranges, and terminal events. The primary estimand was the proportion of ranged affected entries containing at least one `fixed` event. Prespecified sensitivities included withdrawn records, exact-version enumeration, SEMVER-only ranges, pre-2026 records, and exclusion of the largest no-fix source family.
Results: Among 274,705 active ranged entries, 51,540 (18.76%) exposed an explicit fix. Prevalence ranged from 3.74% for npm to 95.51% for RubyGems. Of 223,165 entries without a fix, 207,804 had an open range without enumerated affected versions. However, 214,278 no-fix entries (96.02%) belonged to the `MAL` identifier family, malicious-package advisories whose operational response is removal rather than upgrade to a repaired release. Excluding that family increased explicit-fix prevalence to 85.29% (51,508/60,395). Results were deterministic across two executions.
Conclusions: Corpus-wide endpoint prevalence is dominated by advisory semantics and should not be interpreted as a simple data-quality score. Consumers should distinguish malicious-package removal from repairable-vulnerability upgrading, preserve enumeration and terminal-event provenance, and fail safely when no compatible fixed version is represented.
References
1. OpenSSF. *Open Source Vulnerability format*. OSV Schema, checkout `v1.9.1-1-g65280fa`, commit `65280faa676c7a69bb9208d876b2419f88dd7e03`. https://ossf.github.io/osv-schema/
2. OSV.dev. *Data sources*. https://google.github.io/osv.dev/data/
3. OSV.dev. *Properties of a High Quality OSV Record*. https://google.github.io/osv.dev/data_quality.html
4. Dong Y, Guo W, Chen Y, Xing X, Zhang Y, Wang G. Towards the Detection of Inconsistencies in Public Security Vulnerability Reports. In: *28th USENIX Security Symposium*. 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/dong
5. Ren H, Li X, Lei L, et al. Detecting Inconsistent Vulnerable Software Version in Security Vulnerability Reports. *Communications in Computer and Information Science*. 2022:78–99. https://doi.org/10.1007/978-981-19-0523-0_6
6. Nguyen VH, Dashevskyi S, Massacci F. An automatic method for assessing the versions affected by a vulnerability. *Empirical Software Engineering*. 2016;21(6):2268–2297. https://doi.org/10.1007/s10664-015-9408-2
7. He Y, Wang Y, Zhu S, et al. Automatically Identifying CVE Affected Versions With Patches and Developer Logs. *IEEE Transactions on Dependable and Secure Computing*. 2024;21(2):905–919. https://doi.org/10.1109/TDSC.2023.3264567
8. Wu S, Wang R, Huang K, et al. Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities. In: *Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering*. 2024:1447–1459. https://doi.org/10.1145/3691620.3695516
9. Chen X, Liu C, Cao J, et al. Vulnerability-Affected Versions Identification: How Far Are We? In: *2025 40th IEEE/ACM International Conference on Automated Software Engineering*. 2025:2970–2982. https://doi.org/10.1109/ASE63991.2025.00244
10. Bhandari G, Naseer A, Moonen L. CVEfixes: automated collection of vulnerabilities and their fixes from open-source software. In: *Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering*. 2021:30–39. https://doi.org/10.1145/3475960.3475985
11. OSV-Scanner. *Guided Remediation*. https://google.github.io/osv-scanner/experimental/guided-remediation/
Downloads
Published
Issue
Section
License
Copyright (c) 2026 AlphaTech Systems LLC
This work is licensed under a Creative Commons Attribution 4.0 International License.
AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.
