Layered Reachability Analysis

When a CVE is published against a transitive dependency — a dependency of one of your dependencies — the urgent question is rarely “do we use this library?” It is “is the vulnerable code path actually reachable from our application?” Most software composition analysis (SCA) tooling answers a much weaker question: it confirms that a vulnerable artifact is present on the classpath. Presence is necessary for exploitability, but it is far from sufficient. This paper describes a pragmatic, three-layer method for answering the reachability question with progressively stronger evidence. Layer 1 establishes that the vulnerable artifact is genuinely on the classpath and identifies the transitive path that pulled it in. Layer 2 determines whether the application’s own code, or the intermediate dependency, actually references the vulnerable component at the source level. Layer 3 settles the matter empirically: a lightweight runtime agent built with Byte Buddy instruments the vulnerable method and records whether it is ever invoked while the system runs under representative workloads. The result is a triage process that converts a wall of undifferentiated “vulnerable” findings into a ranked, evidence-backed list — letting teams remediate what is genuinely exploitable, defer what is not, and document the reasoning behind every decision.