Grype misses critical CVEs for vendored libraries owned by unrelated RPMs

Author: sekveajaCreated Aug 21, 2026Updated Aug 21, 2026

Labelsbug

Description

Grype fails to detect vulnerabilities (e.g., CVE-2025-15467 Critical) for vendored OpenSSL binaries when the file is owned by an unrelated RPM package. The internal exclude-binary-overlap-by-ownership: true (default) logic silently suppresses the binary detection because the file has RPM ownership — even though the owning RPM has nothing to do with OpenSSL.

Steps to Reproduce

1. Save the Dockerfile below as Dockerfile.grype-issue and build:

bash

docker build -f Dockerfile.grype-issue -t grype-binary-cataloger-issue .

2. Dockerfile:

dockerfile

FROM registry.suse.com/bci/bci-base:15.7

# Install system OpenSSL 3.2.3 via RPM
RUN zypper --non-interactive refresh && \
    zypper --non-interactive install --no-confirm openssl-3 libopenssl3 rpm-build && \
    zypper clean --all

# Build OpenSSL 3.5.0 into /opt/VendorProduct
RUN zypper --non-interactive install --no-confirm gcc gcc-c++ make perl wget tar gzip && \
    zypper clean --all

ARG OPENSSL_VERSION=3.5.0
RUN wget -q https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz \
        -O /tmp/openssl-${OPENSSL_VERSION}.tar.gz && \
    tar -xzf /tmp/openssl-${OPENSSL_VERSION}.tar.gz -C /tmp && \
    cd /tmp/openssl-${OPENSSL_VERSION} && \
    ./Configure --prefix=/opt/VendorProduct --openssldir=/opt/VendorProduct/ssl shared linux-x86_64 && \
    make -j$(nproc) && make install_sw && \
    rm -rf /tmp/openssl-${OPENSSL_VERSION}* /opt/VendorProduct/include /opt/VendorProduct/lib64/pkgconfig

# Package vendored OpenSSL into an unrelated RPM (triggers the bug)
RUN cat > /tmp/vendor-product.spec << 'EOF'
Name:           vendor-product
Version:        1.0.0
Release:        1
Summary:        Vendor product bundling OpenSSL
License:        Commercial
BuildArch:      x86_64
AutoReqProv:    no
%description
Simulates a vendor RPM that bundles OpenSSL with no OpenSSL metadata.
%install
mkdir -p %{buildroot}/opt/VendorProduct
cp -a /opt/VendorProduct/* %{buildroot}/opt/VendorProduct/
%files
/opt/VendorProduct
EOF
RUN rpmbuild -bb /tmp/vendor-product.spec && \
    find /usr/src/packages/RPMS -name "*.rpm" -exec rpm -ivh {} \; && \
    rm -rf /usr/src/packages /tmp/vendor-product.spec


# Cleanup build tools
RUN zypper --non-interactive remove --no-confirm gcc gcc-c++ make perl wget tar rpm-build || true && \
    zypper clean --all

# Verify both versions exist
RUN openssl version && \
    LD_LIBRARY_PATH=/opt/VendorProduct/lib64 /opt/VendorProduct/bin/openssl version && \
    rpm -qf /opt/VendorProduct/bin/openssl

CMD ["/bin/bash"]

3. Grype scan — MISSES CVE-2025-15467:

bash

$ grype grype-binary-cataloger-issue | grep CVE-2025-15467
(no output)

4. Verify the binary IS detectable (using syft with overlap disabled):

bash

$ syft grype-binary-cataloger-issue -c <(echo 'package:
    exclude-binary-overlap-by-ownership: false') | grep openssl
openssl                                 3.2.3                  binary
openssl                                 3.2.3-150700.1.1       rpm
openssl                                 3.5.0                  binary

5. Verbose output shows the binary cataloger DID find it, but it was suppressed:

bash

$ syft grype-binary-cataloger-issue -vv 2>&1 | grep -i "binary-classifier\|ownership"
      exclude-binary-overlap-by-ownership: true
[0007] DEBUG discovered 8 packages cataloger=binary-classifier-cataloger

What Happens

Grype's internal Syft binary-classifier-cataloger correctly detects OpenSSL 3.5.0
The file /opt/VendorProduct/bin/openssl is owned by RPM vendor-product-1.0.0 (an unrelated package)
exclude-binary-overlap-by-ownership: true suppresses the binary finding because "the file is already owned by an RPM"
The owning RPM (vendor-product) has no OpenSSL metadata → no CVE is matched
Result: CVE-2025-15467 (Critical) goes undetected. No warning is emitted.

Expected Behavior

Grype should detect CVE-2025-15467 for the vendored OpenSSL 3.5.0 binary. The overlap exclusion should not suppress a binary detection when the owning RPM's name (vendor-product) does not match the detected software (openssl).

Actual Behavior

Grype reports no CVE for OpenSSL 3.5.0. The vulnerability is silently missed.

Real-World Impact

This affects any enterprise software that bundles third-party libraries inside vendor RPMs:

Micro Focus/OpenText VisiBroker
Oracle products
SAP
Any COTS software with bundled dependencies

Workaround

There is no direct Grype configuration to disable this. The only workaround is a two-step scan:

bash

syft <image> -c <(echo 'package:
    exclude-binary-overlap-by-ownership: false') -o json > sbom.json
grype sbom:sbom.json

This requires standalone Syft to be installed separately.

Environment

Grype: 0.117.0
OS: SUSE Linux Enterprise 15 SP7

Source: anchore/grype

View original on GitHub View discussion on GitHub