Multi-patch vulnerability fixes can leave open source exposed

Researchers analyzed 1,646 open-source CVEs with multi-commit fixes and found that many vulnerabilities require multiple patches across branches or locations, with 641 cases of incomplete/defective initial fixes and long windows (31.7% > 1 day) between first and last patches. Common detection models and clone detectors perform poorly on these intermediate states, increasing the structural risk that public fixes in one place could reveal unpatched equivalents elsewhere; patch metadata and non-security commits further complicate automated analysis.