The Secret Life of CVEs
Published: Apr 4, 2025
Last Updated: Apr 4, 2025
Authors:Piotr Przymus, Mikołaj Fejzer, Jakub Narębski, Krzysztof Stencel
Abstract
The Common Vulnerabilities and Exposures (CVEs) system is a reference method for documenting publicly known information security weaknesses and exposures. This paper presents a study of the lifetime of CVEs in software projects and the risk factors affecting their existence. The study uses survival analysis to examine how features of programming languages, projects, and CVEs themselves impact the lifetime of CVEs. We suggest avenues for future research to investigate the effect of various factors on the resolution of vulnerabilities.