The flood of LLM-assisted vulnerability reports has overwhelmed maintainers and security teams alike. Sys Admins, SREs, and App Sec teams face daily new CVEs requiring assessment and patching. VEX documents offer a machine-readable way to state whether a software product is actually exposed to a known vulnerability, enabling smarter triage.
SBOM-based scanning often flags vulnerabilities that aren't actually reachable in code, creating noise. For example, a simple Go program using golang.org/x/text v0.38.0 shows two CVEs via grype, but neither affects the program as the vulnerable functions are unused. Manual VEX creation is possible but doesn't scale with codebase size or dependency changes.
Reachability analysis via tools like govulncheck solves this by using static analysis and the Go vulnerability database to identify only exploitable flaws. In the sample, govulncheck reports zero vulnerabilities in the code, despite finding issues in dependencies. This approach allows teams to patch only when truly affected, reducing noise and manual effort.
However, this model breaks down for operating systems due to complex, dynamic environments where static reachability is harder to guarantee. VEX remains promising, but automation depends on the ecosystem's ability to provide precise, machine-actionable exploitability data.
Source: Hacker News · Summarized by HeadlinesBriefing