SonarQube introduces vulnerability reachability analysis

SonarQube has introduced vulnerability reachability analysis within its Advanced Security platform. This feature aims to address the issue of security teams being overwhelmed by large backlogs of vulnerabilities in third-party dependency trees.

By performing call graph analysis on a codebase, the tool determines whether an application actually executes the specific functions associated with a detected vulnerability. This allows security teams to prioritize risks that are confirmed to be reachable, rather than spending resources on vulnerabilities that exist in code paths the application never touches.