False positive CVE-2025-35036 — hibernate-validator 6.0.23.SP1-redhat-00001 flagged but Red Hat backported the fix

Reproduce

cat > /tmp/sbom_CVE-2025-35036.json << 'EOF'
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "components": [{
    "type": "library",
    "name": "hibernate-validator",
    "version": "6.0.23.SP1-redhat-00001",
    "group": "org.hibernate.validator",
    "purl": "pkg:maven/org.hibernate.validator/[email protected]"
  }]
}
EOF
grype sbom:/tmp/sbom_CVE-2025-35036.json

or with docker file FROM registry.access.redhat.com/ubi8/ubi-minimal:latest COPY hibernate-validator-6.0.23.SP1-redhat-00001.jar /opt/lib/hibernate-validator-6.0.23.SP1-redhat-00001.jar

Expected

No vulnerability reported for CVE-2025-35036.

Actual

hibernate-validator 6.0.23.SP1-redhat-00001 6.2.0.CR1 java-archive CVE-2025-35036 High

Root Cause

The upstream GitHub Advisory only lists 6.2.0.CR1 as the patched version. It does not account for Red Hat's backport into the 6.x maintenance stream.

Evidence that 6.0.23.SP1-redhat-00001 includes the fix

• Red Hat Errata: 10925:https://access.redhat.com/errata/RHSA-2025:10925
• Red Hat CVE API: curl -s https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-35036.json
  | jq '.affected_release[] | select(.product_name | test("6.0.23.SP1-redhat-00001"))'
• GHSA advisory: https://github.com/advisories/GHSA-7v6m-28jr-rg84
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-35036

Suggested Fix

Grype should recognize OS vendor backport versioning conventions. When a package version contains a vendor suffix (e.g. -redhat-, -suse-, -debian-), Grype could consult the vendor's CVE API to verify if the fix was backported before flagging it as vulnerable.

Grype version: 0.112.0