Skip to content

gnu:ncurses CPE returns zero vulnerability matches despite active NVD CVE (CVE-2023-29491) covering affected version #1298

Description

@Alex-Moraru

Querying Grype directly for cpe:2.3:a:gnu:ncurses:6.1:::::::* returns zero vulnerability matches, despite CVE-2023-29491 (NVD, CVSS 3.1 7.8 High) explicitly listing ncurses before 6.4 20230408 as affected — which includes version 6.1.

This CVE was previously matching correctly in earlier DB builds and disappeared from scan results as of the DB build below. Direct CPE query bypasses SBOM/scan-pipeline matching logic entirely, so this points to a gap in the underlying vulnerability data rather than a matcher issue.

Steps to reproduce

grype cpe:2.3:a:gnu:ncurses:6.1:::::::*

Expected result

At least one match for CVE-2023-29491 (and any other CVEs affecting ncurses < 6.4).

Actual result

✔ Scanned for vulnerabilities [0 vulnerability matches]
├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
└── by status: 0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found

Environment

Path: /home/blinq/.cache/grype/db/6/vulnerability.db
Schema: v6.1.9
Built: 2026-08-08T06:22:53Z
From: https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.9_2026-08-08T00:20:31Z_1786170173.tar.zst
Status: valid

Confirmed persistent across a subsequent grype db update check (no new DB was available at time of retest).

Reference

CVE-2023-29491: https://nvd.nist.gov/vuln/detail/CVE-2023-29491
Affected range per NVD/Debian security tracker: ncurses before 6.4 20230408

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    • Status
      No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions