Measuring and Understanding Expectation Inconsistency in Java Libraries

Java libraries sometimes work differently than their developers intended, creating a security problem called 'expectation inconsistency' where programmers misuse the libraries and accidentally introduce vulnerabilities. Researchers created a tool called EIFinder that scanned nearly 30,000 popular Java libraries and found nearly 8,000 APIs (pre-built functions) with this problem, including 972 zero-day RCE (remote code execution, where attackers can run commands on a system) vulnerabilities affecting libraries from major companies like Google, Apache, and IBM.