It means analysis found no path from your code to the vulnerable function in that package. That lowers urgency, because an attacker usually needs a way to trigger the flaw. It does not make the finding go away, since code changes and the analysis can miss paths.
What reachability checks
A package may contain thousands of functions, and an advisory usually affects one or two. Reachability analysis looks at how your code and its dependencies call each other and asks whether any call chain ends in the vulnerable function. If none does, the flaw is present but dormant.
Why it helps
Findings pile up. Most are in packages where your application never uses the affected feature. Marking those as lower priority lets a team spend its time on the ones an attacker could actually trigger.
Where it can mislead
- Dynamic behaviour. Code that loads things by name at runtime can hide a call path.
- Configuration. A setting you enable later can make a dormant path live.
- Future changes. A new feature, or a new dependency update, can start calling the function.
- Incomplete graphs. Some languages and frameworks are harder to analyse than others.
A safe way to use it
Treat unreachable as deferred, not closed. Keep the finding visible, tag it with the reason, and re-check when you change the dependency or the code around it. If the flaw is severe and a fix is easy, just upgrade anyway.
What to record
Write down the package, the advisory, the date and the reason it is considered unreachable. Auditors and customers ask for this, and your future self will too.
Combine it with exploitability
Reachable and exploited in the wild is the top of your list. Unreachable and no known exploitation can wait for a routine upgrade. The cases in between need judgement.
Try it yourself
Click through it at your own pace, or open it full screen. Compare the full findings list with the reachable subset and check which ones remain at the top.
Quick check
Can I close an unreachable finding?
Better to defer it with a reason and a review date. Code changes can make it reachable later.
Is reachability analysis perfect?
No. Dynamic code and configuration can hide paths, so treat it as a priority signal.
Last reviewed: 19 October 2026.
