Vulnerable Function Reachability
The distinction between component presence, vulnerable component relevance, vulnerable function usage, and exploitability. How reachability analysis provides evidence about code paths and usage, and why reachability does not by itself prove exploitability.
Primary question: How can security teams determine whether application code actually reaches vulnerable functionality inside a dependency?
Direct answer
Reachability analysis traces the code path from application code through imports to vulnerable functions inside dependencies
Reachability analysis traces the code path from application code through import statements to vulnerable functions inside dependencies. It establishes whether vulnerable functionality is actually used, but does not by itself prove exploitability. [derscanner-sca]
The distinction is critical — a vulnerable component being present does not mean its vulnerable functionality is used; a vulnerable function being used does not mean the vulnerability is exploitable. Reachability provides evidence about code paths, not exploitability. [derscanner-sca]
Call trace data shows the sequence of imports and function calls that lead to vulnerable functionality, enabling security teams to understand the code path and assess residual risk factors such as reflection, dynamic loading, and configuration-dependent paths. [derscanner-sca]
Definitions
Vulnerable function reachability
A layered determination that proceeds through: (1) component presence - the vulnerable package is in the project; (2) import/module use - the vulnerable module is imported or referenced by application code; (3) call-graph reachability - a path exists from application code to the vulnerable function through imports and function calls; (4) data-flow or precondition satisfaction - attacker-controlled input can reach the vulnerable state, when separately supported by the analyzer. Import presence alone is not reachability. Call-graph reachability does not prove that attacker-controlled data reaches a vulnerable state. Data-flow reachability must not be assumed unless the analyzer explicitly supports it.
Call trace
A record of the code path from application code through import statements to the vulnerable function inside a dependency. A call trace shows the sequence of imports and function calls that lead to the vulnerable functionality.
Direct dependency reachability
Evidence that vulnerable functionality in a directly declared dependency is reached from application code through explicit imports and function calls.
Transitive dependency reachability
Evidence that vulnerable functionality in a transitive (indirectly declared) dependency is reached from application code through a chain of imports and function calls that passes through one or more intermediate dependencies.
The engineering problem
SCA analysis identifies vulnerable components but does not determine whether the vulnerable functionality inside those components is actually reached from application code. A vulnerable component may have many functions, and only some may be used by the application. [derscanner-sca]
Without reachability analysis, teams cannot distinguish between a vulnerable component that is imported and called from application code and a vulnerable component that is present but not used, making prioritization less accurate. [derscanner-sca]
Reachability analysis provides evidence about code paths but does not prove exploitability. Residual risks such as reflection, dynamic loading, configuration-dependent paths, and runtime behavior may make a static result of "not found reachable" an incorrect assessment in specific deployment contexts. [derscanner-sca]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Import analysis
Dependency import detection- Artifact
- Application source code import statements referencing dependency modules.
- Risk
- Vulnerable dependencies that are imported but not evaluated for reachability of their vulnerable functions.
- Output
- List of all dependency imports in the application code, with version information.
Evidence: DerScanner software composition analysis documentation
Function call tracing
Call trace analysis- Artifact
- Application source code, dependency source code, and call graph data.
- Risk
- Vulnerable functions inside dependencies that are called from application code but not identified through import analysis alone.
- Output
- Call trace data showing the sequence of imports and function calls from application code to vulnerable functions inside dependencies.
Evidence: DerScanner software composition analysis documentation
Reachability assessment
Vulnerable function reachability analysis- Artifact
- SCA findings correlated with SAST findings to determine which vulnerable dependency functions are actually reached.
- Risk
- Vulnerable components whose vulnerable functionality is not reached from application code, leading to over-prioritization.
- Output
- Reachability evidence for each vulnerable component, indicating whether its vulnerable functionality is reached, and if so, through which code path.
Evidence: DerScanner software composition analysis documentation
Verification workflow
- Run SCA analysis to identify all vulnerable components in the project.
- Run SAST analysis to identify all import statements and function calls in the application source code.
- For each vulnerable component, determine whether its modules are imported by application code.
- For each imported vulnerable module, trace the function calls from application code to the vulnerable function inside the dependency.
- Construct call traces showing the full code path from application code through imports to vulnerable functions.
- Assess direct vs. transitive dependency reachability — determine whether the vulnerable function is reached through a direct import or through a chain of intermediate dependencies.
- Use reachability evidence for prioritization — reachable vulnerable functions are higher priority than unreachable ones.
- Evaluate residual risks — consider reflection, dynamic loading, configuration-dependent paths, and runtime behavior that may make a static result of "not found reachable" a false negative in specific contexts.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides hybrid SAST+SCA analysis to determine which vulnerable dependency functions are reached from application code.
DerScanner performs hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization, including reachability analysis. [derscanner-sca]
Limits of verification
- Reachability analysis provides evidence about code paths but does not by itself prove exploitability. A static result of "not found reachable" may be a false negative because unsupported dynamic behavior, reflection, native boundaries, framework behavior, or configuration can create runtime paths not represented in the static model.
- Dynamic imports and framework-level dependency injection may introduce code paths that are difficult to trace statically.
- Production acceptance remains an organizational engineering decision.
Related knowledge
SBOM vs SCA vs Hybrid Analysis
Hybrid analysis as the third layer of dependency security
Relationship: related-toHybrid SAST + SCA Analysis
Overview of hybrid SAST+SCA analysis concept and engineering model
Relationship: related-toReducing SCA Noise with Reachability
How reachability analysis helps prioritize SCA findings
Relationship: related-toDependency Security for AI-Generated Code
Umbrella page covering the broader dependency security analysis model
Relationship: related-toDerScanner
Product line providing reachability analysis capabilities
Relationship: related-toCanonical terms used: Vulnerable function reachability; Call trace; Direct dependency reachability; Transitive dependency reachability.
Evidence and references
- DerScanner software composition analysis documentationDerScanner SCA identifies component vulnerabilities, dependencies, software supply chain risks, and license risks. DerScanner provides hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization, including reachability analysis.
derscanner-sca
Analyze vulnerable function reachability