Reachable CVE Gate

Gate ID: reachable-cve

Blocks only CVEs with confirmed reachable code paths from application entry points. This gate leverages Stella’s reachability analysis to distinguish exploitable vulnerabilities from those in unreachable code.

This gate is not a CVE-id denylist. A rule that matches only finding.cve_id == "CVE-..." is presence-based evidence and must be reported as matchClass=denylist, even when its rationale mentions an entrypoint, shell, libc, or likely runtime use. A reachability-backed block must cite a completed finding with matchClass=reachability; unknown, computing, and plain package presence are not reachability proof.

How It Works

Evaluates CVE findings against reachability analysis results
Filters to only reachable CVEs (code path exists from entry point to vulnerable function)
Applies severity threshold to reachable CVEs
Blocks if reachable CVEs exceed severity threshold

Configuration

{
  "Policy": {
    "Gates": {
      "ReachableCve": {
        "Enabled": true,
        "SeverityThreshold": 7.0,
        "RequireCompleteReachability": false,
        "TreatUnknownAsReachable": false,
        "BlockOnReachabilityError": false,
        "Environments": {
          "production": {
            "SeverityThreshold": 4.0,
            "TreatUnknownAsReachable": true
          }
        }
      }
    }
  }
}

Options

Option	Type	Default	Description
`Enabled`	bool	`true`	Whether the gate is active
`SeverityThreshold`	double	`7.0`	CVSS score threshold for reachable CVEs
`RequireCompleteReachability`	bool	`false`	Require reachability analysis for all components
`TreatUnknownAsReachable`	bool	`false`	Treat CVEs with unknown reachability as reachable
`BlockOnReachabilityError`	bool	`false`	Fail gate if reachability analysis fails
`Environments`	dict	`{}`	Per-environment overrides

Reachability States

State	Description	Default Behavior
`Reachable`	Code path confirmed from entry point	Subject to severity threshold
`NotReachable`	No code path found	Allowed (not blocked)
`Unknown`	Reachability not analyzed	Depends on `TreatUnknownAsReachable`
`Partial`	Some paths reachable	Treated as reachable

Base-Image OS Packages

Base-image packages need explicit evidence before this gate can treat them as reachable. For example, busybox may provide /bin/sh or PID 1, and libc may be loaded by every process, but those are not automatically proven by an application source callgraph. Until Scanner/ReachGraph emits an explicit base-image inference fact, those package CVEs should be handled by an honest denylist/backstop rule with matchClass=denylist.

The cheaper S051 path is to add deterministic base-image facts for:

the package owning the effective container ENTRYPOINT/CMD executable or PID 1 binary, such as busybox-backed /bin/sh;
the runtime loader/libc package that is required by the entrypoint process, such as musl on Alpine.

Those facts must include the observed executable/library path, package PURL, source image digest, analyzer version, and evidence reference. Without that record, the correct policy state remains unknown for reachability, even if a separate denylist blocks the CVE.

Example Gate Results

Pass:

Reachable CVE check passed. 8 CVE(s) found, 2 reachable, none above threshold 7.0

Pass (no reachable):

Reachable CVE check passed. 15 CVE(s) found, 0 reachable (all in unreachable code)

Fail:

Reachable high-severity CVE(s) found: CVE-2024-1234 (CVSS: 9.1, reachable via /api/upload), CVE-2024-5678 (CVSS: 7.5, reachable via /auth/login)

CLI Usage

# Evaluate reachable CVE gate
stella policy evaluate --gate reachable-cve --image myapp:v1.2.3

# With specific severity threshold
stella policy evaluate --gate reachable-cve --severity 9.0 --image myapp:v1.2.3

# Treat unknown as reachable (conservative)
stella policy evaluate --gate reachable-cve --treat-unknown-reachable --image myapp:v1.2.3

Integration with Reachability Analysis

This gate requires reachability analysis results from the Stella Scanner. Ensure images are scanned with reachability enabled:

stella scan --image myapp:v1.2.3 --reachability

Reachability analysis examines:

Container entry points (ENTRYPOINT, CMD)
Exposed ports and expected protocols
Call graphs from entry points to vulnerable functions
Language-specific dependency loading patterns

Last updated: 2026-01-19.