False positives on CPython 3.12.14: missing 3.12 backport for CVE-2026-3644, CVE-2026-4224, CVE-2026-7210

What happened

Grype reports three HIGH CPython findings against python 3.12.14, but 3.12.14 is the fixed version for all three. The FIXED IN column lists only the 3.13 / 3.14 / 3.15 branches and omits the 3.12 backport, so any image on the 3.12 series matches as vulnerable with no reachable fix inside that series.

Each authoritative CVE record in CVEProject/cvelistV5 lists CPython as version: 3.12.0, lessThan: 3.12.14, status: affected. lessThan: 3.12.14 means 3.12.14 itself is not affected — the 3.12 branch received a backport. Grype showing a fix only on 3.13+ implies that 3.12 fixed-in entry is missing from the vulnerability data, not that 3.12 was left unpatched.

Steps to reproduce

docker run --rm anchore/grype:v0.116.1 python:3.12-alpine3.24 -o table

Actual output

NAME           INSTALLED   FIXED IN                       TYPE    VULNERABILITY        SEVERITY    EPSS          RISK
python         3.12.14     *3.13.13, 3.14.4, 3.15.0a8     binary  CVE-2026-4224        High        0.7% (50th)   0.5
python         3.12.14     *3.13.14, 3.14.6, 3.15.0b2     binary  CVE-2026-7210        High        0.7% (49th)   0.5
python         3.12.14     *3.13.13, 3.14.4, 3.15.0a8     binary  CVE-2026-3644        High        0.5% (39th)   0.3

Expected output

No findings for these three CVEs. The scanned interpreter is 3.12.14, which is at or above the 3.12-series fixed version in every one of the three CVE records.

Environment

Application:         grype
Version:             0.116.1
BuildDate:           2026-07-28T21:39:06Z
GitCommit:           30394f177175da63ae36b35cdd809c248eb4de7f
GitDescription:      v0.116.1
Platform:            linux/arm64
GoVersion:           go1.26.3
Compiler:            gc
Syft Version:        v1.50.0
Supported DB Schema: 6

Path:      /.cache/grype/db/6/vulnerability.db
Schema:    v6.1.9
Built:     2026-09-08T06:30:10Z
From:      https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.9_2026-09-08T00:33:13Z_1788849010.tar.zst
Status:    valid

The database above was downloaded fresh on 2026-09-08, so this is current data rather than a stale local cache.

Why this matters

This is not cosmetic for projects pinned to the 3.12 series. Our release admission gate blocks any deploy carrying an unwaived HIGH finding, so these three false positives block every backend deploy until each is individually waived — a waiver we have to keep renewing on a timer for vulnerabilities our image does not have. The remedies grype suggests (3.13 / 3.14 / 3.15) are not available to a project pinned to >=3.12.0,<3.13, so the findings read as permanently unfixable when in fact they are already fixed.

Suggested fix

Add the 3.12.14 fixed-in entry for these three CVEs so the 3.12 branch is matched against its own backport.

It may be worth checking whether other CPython CVEs with 3.12 backports in this window are missing the same entry. The shape is consistent across all three — 3.13/3.14/3.15 fixed-in present, 3.12 absent — which looks more like the 3.12 branch being dropped somewhere in ingestion than three independent data-entry errors.