Alpine curl version mismatch in findings: Grype reports 8.5.8 while container has 8.21.0-r0 installed

We are scanning an Alpine-based container image and seeing curl vulnerabilities attributed to curl version 8.5.8. Inside the built image, apk shows curl/libcurl at 8.21.0-r0. This appears to be package version attribution mismatch rather than actual installed-package state.

Evidence from container

apk owner check: /usr/lib/libcurl.so.4 is owned by libcurl-8.21.0-r0 installed packages: curl-8.21.0-r0 curl-dev-8.21.0-r0