Contextual Analysis of CVEs
Learn how Contextual Analysis flags only exploitable CVEs in your artifacts.
When scanning for vulnerabilities, traditional tools often flag a large number of CVEs, most of them irrelevant. Sorting real risk from noise is slow and error-prone, and many of the reported vulnerabilities never affect the scanned artifact at all.
JFrog Vulnerability Contextual Analysis addresses this by flagging only CVEs that are actually exploitable in the scanned artifact. It runs a set of automated scanners, built and maintained by the JFrog Security Research team, that inspect multiple facets of your artifact to determine whether a CVE is truly exploitable: first-party code usage of the library, binary compilation, configuration, invocation, and runtime environment.
Approximately one-third of JFrog's contextual analysis scanners deliberately don't rely on reachability, because for many CVEs the evidence of exploitability never appears in source or binary code. It lives in configuration files, command-line flags, or properties of the host. The analysis produces a justification for every result, including which signals the scanner looked for, so you can learn and verify the finding against your code and environment.
JFrog Contextual Analysis coverage spans both source code and compiled binaries, including Docker/OCI images and Uber/Fat JARs. For more information, see Supported Technologies and Package Applications in Docker for Contextual Analysis.
Automated scanners are built by the JFrog Research group. With a JFrog Advanced Security subscription, you can request research from the dedicated team. If a CVE lacks a contextual analysis scanner, the team prioritizes building support for it.
Note
For more information, see Contextual Analysis at JFrog Academy.
Key Benefits
- Reduces false positives: Filters out vulnerabilities that don’t impact your software today.
- Detects exploitability that reachability alone would miss: For vulnerabilities gated by configuration files, command-line flags, compile-time options, or properties of the runtime host.
- Provides actionable insights: Highlights vulnerabilities with real-world impact. In the case of binary analysis, there is more context that allows for the analysis of the complete codebase from an attacker's perspective, identifying which issues are truly exploitable and what their potential impact is.
- Actionable remediation: Enables targeted mitigation based on the actual code, artifact, build, or Release Bundle.
- Seamless integration for developers: View results directly in your IDE, CLI, PR decoration (Frogbot), and the JFrog Platform.
Transitive Dependency Analysis
The Transitive Dependency feature in JFrog Advanced Security enhances contextual analysis by identifying vulnerabilities that are not directly in your code but are introduced through transitive dependencies (dependencies of your dependencies).
For each CVE, the analysis shows:
- The call chain in your code that leads to the vulnerable function.
- Whether the call is direct (in your code) or transitive (through another dependency).
- A call graph button that visualizes the dependency path.
- Highlighted functions and file paths where the vulnerable function is used.
- A copy-to-clipboard option for evidence such as function names, file paths, and line numbers.
This helps you understand exactly why a CVE is applicable in your project and where it is triggered.
Frequently Asked Questions
This section provides answers to frequently asked questions.
FAQs
Q: What does Vulnerability Contextual Analysis check?
A: It inspects first-party code usage, binary compilation, configuration, invocation, and runtime environment to decide whether a CVE is exploitable in your artifact. The result includes a justification that lists the signals the scanner looked for.
Q: Does Contextual Analysis rely only on reachability?
A: No. About one-third of JFrog contextual analysis scanners don't use reachability, because exploitability often lives in configuration files, command-line flags, or host properties. See What Applicability Analysis Checks for the techniques a scanner can combine.
Q: What do Applicable and Not Applicable mean?
A: Applicable means the vulnerability can be exploited in the scanned code or artifact. Not Applicable means it cannot be exploited in that context. Other statuses cover cases such as missing scanners, missing context, or an Xray upgrade. See Vulnerability Contextual Analysis Statuses.
Q: When should I rescan or upgrade Xray for Contextual Analysis?
A: Use Rescan Required when a new scanner exists for the CVE and you need a fresh scan to get applicability results. Use Upgrade Required on self-managed environments when JFrog Xray must be updated before that scanner is available.
Q: How do I view transitive dependency analysis?
A: After a scan, open a CVE in Scan Results, then open the Contextual Analysis tab and switch between Direct and Transitive views. See Viewing Transitive Dependency Analysis for the full steps.
Q: Which JFrog Xray versions add Rust and .NET binary analysis in Docker?
A: Rust binaries in Docker containers are supported in JFrog Xray 3.79.x and later. .NET binaries in Docker containers are supported in JFrog Xray 3.95.4 and later. See Version-Specific Support.
Related Topics
Updated 21 days ago