LAYERED REACHABILITY ANALYSIS

When a CVE is published against a transitive dependency — a dependency of one of your

dependencies — the urgent question is rarely “do we use this library?” It is “is the vulnerable code

path actually reachable from our application?” Most software composition analysis (SCA) tooling

answers a much weaker question: it confirms that a vulnerable artifact is present on the classpath.

Presence is necessary for exploitability, but it is far from sufficient.

This paper describes a pragmatic, three-layer method for answering the reachability question with

progressively stronger evidence. Layer 1 establishes that the vulnerable artifact is genuinely on

the classpath and identifies the transitive path that pulled it in. Layer 2 determines whether the

application’s own code, or the intermediate dependency, actually references the vulnerable

component at the source level. Layer 3 settles the matter empirically: a lightweight runtime agent

built with Byte Buddy instruments the vulnerable method and records whether it is ever invoked

while the system runs under representative workloads.

The result is a triage process that converts a wall of undifferentiated “vulnerable” findings into a

ranked, evidence-backed list — letting teams remediate what is genuinely exploitable, defer what

is not, and document the reasoning behind every decision.