Multi-patch vulnerability fixes can leave open source exposed

A recent study reveals that many open source security fixes involve multiple patches, creating a window of vulnerability between the initial and final commits. Researchers analyzed 1,646 CVEs with more than one patch in the National Vulnerability Database and found that some fixes are incomplete or delayed, exposing users to potential attacks. For example, CVE-2012-0038 required two separate commits to fully resolve an integer overflow issue. Automated detection tools failed to identify these partial fixes accurately, highlighting a critical gap in current vulnerability management practices.