What Is Reachability Analysis?

Reachability analysis is the process of determining whether the vulnerable code inside a dependency can actually be executed by your application, for example whether any call path leads from your code to the affected function. It separates vulnerabilities that are merely present in your dependency tree from those your software can trigger.

How reachability is determined

Tools work at different depths:

• Package or import level: is the vulnerable package imported at all, or only installed?
• Function or symbol level: static analysis builds a call graph from your code and checks whether it reaches the specific functions named in the advisory. Go's govulncheck is a widely used example. It reports only vulnerabilities in functions your code appears to call, using symbol data from the Go vulnerability database.
• Runtime: instrumentation records which code paths actually execute in a running environment.

Each depth has limits. Static call graphs struggle with reflection, dynamic dispatch, dependency injection and code loaded at runtime, so "unreachable" can be wrong. Many advisories do not name the vulnerable function, which forces tools back to the package level. Reachability is also a snapshot: the next commit can make a path reachable. Treat "not reachable" as evidence for a documented decision, such as a VEX "not affected" justification that the vulnerable code is not in the execution path, rather than as proof of safety.

How GeekWala relates to reachability

GeekWala prioritizes by exploitation evidence (EPSS probability and CISA KEV status) rather than by call-graph reachability. The two answer different questions. Reachability asks whether your code can trigger a flaw. EPSS and KEV ask whether attackers are exploiting it, regardless of your own call graph. A reachable, KEV-listed vulnerability is the clearest emergency there is: attackers are already exploiting it, and your code can execute the affected path. Combining both signals with the CVSS severity score gives a fuller picture than any one of the three alone.

Sources: govulncheck documentation

Related terms

• VEX (Vulnerability Exploitability eXchange)
• EPSS (Exploit Prediction Scoring System)
• CVSS (Common Vulnerability Scoring System)

Read the full guide · What dependency vulnerability scanning is · Back to the glossary

Last updated September 14, 2026