Measuring and Understanding Expectation Inconsistency in Java Libraries

doi:10.1109/tifs.2026.3716221

Measuring and Understanding Expectation Inconsistency in Java Libraries

2026-07-23

0

PRE

AI

杨广亮 (Guangliang Yang)

DOI：10.1109/tifs.2026.3716221

Original

Original request for help

Save

Abstract

En 中文

Java libraries have been an essential part of the Java application ecosystem. There are already more than 62.3 million libraries in the Maven repository, across diverse domains such as mobile, desktop, web servers, and Internet of Things. However, Java library APIs may be wrongly understood and thus misused, inadvertently introducing extra security risks. One important reason is the presence of inconsistencies between the actual functionalities of libraries and the design intentions and expectations of their developers. We refer to such a crucial security risk as “expectation inconsistency”. In this paper, we aim to understand the security implications stemming from the expectation inconsistency problem within the context of Java libraries. We propose an automated approach, EIFinder, against the expectation inconsistency problem in Java libraries. By applying EIFinder on 29,149 real-world popular Java libraries, we assess the security impacts and implications of the inconsistency problem. EIFinder discovered 13,982 sensitive library APIs in 511 libraries, and unveiled that 8,156 of these APIs may suffer expectation inconsistency issues, impacting 246 libraries. By sampling 1,145 suspicious APIs, we have manually confirmed the discovery of 972 zero-day remote code execution (RCE) vulnerabilities. These vulnerabilities threatened 118 real-world popular libraries, including those developed by renowned communities such as Google, Apache, and IBM.

Keywords:

Java library APIs

supply chain security

Measuring and Understanding Expectation Inconsistency in Java Libraries

Abstract

Journal

Organization

Cited Papers