SPFinder: Improving the Context Length and Scalability for Tracing Known Vulnerability Patches

Abstract

An upstream task for vulnerability management is the accurate localization of the patch that fixes a vulnerability. Existing works have proposed several approaches to trace or retrieve the patching commit for fixing a CVE. However, they suffer from two major challenges: (1) they cannot effectively handle the long diff code in patch commits, which is common when commit messages are non-informative; and (2) they do not scale to the full repository with satisfactory accuracy in realistic settings. We propose SPFinder, a scalable and effective retrieval framework for tracing known vulnerability patches. To address the long-context challenge, SPFinder introduces a hierarchical embedding technique that efficiently extends context coverage while mitigating long-context degradation, enabling effective modeling of all files in the commit. To address the scalability challenge, SPFinder adopts a three-phase retrieval framework that balances effectiveness and efficiency, achieving high recall at the full-repository level. Our evaluation on two datasets shows that SPFinder outperforms state-of-the-art patch tracing methods, including PatchFinder, PatchScout, and VFCFinder, by a large margin, and surpasses VoyageAI, a leading commercial code embedding model, on MRR and Recall@10 by 18% and 28%, respectively. Using SPFinder, we successfully traced and merged patch links for 35 CVEs in the GitHub Advisory Database, demonstrating its practical applicability. An ablation study further confirms that hierarchical embedding is a practically effective solution for handling long context in patch retrieval. Our artifacts and online demo are publicly available at https://github.com/AnonySE26/SPFinder and http://spfinder.org/.