Suppose you have vulnerable library,
vuln-lib.jar, that you then import into your source code but never actually use:
#My imports import com.vuln.lib.* #My code ..
And you go onto to deploy this application to a server. Is it possible to exploit a known vulnerability in this library even if your code does not use any of the classes the library provides as part of the source code? And if so, how would that happen?