Querying Grype directly for cpe:2.3:a:gnu:ncurses:6.1:::::::* returns zero vulnerability matches, despite CVE-2023-29491 (NVD, CVSS 3.1 7.8 High) explicitly listing ncurses before 6.4 20230408 as affected — which includes version 6.1.
This CVE was previously matching correctly in earlier DB builds and disappeared from scan results as of the DB build below. Direct CPE query bypasses SBOM/scan-pipeline matching logic entirely, so this points to a gap in the underlying vulnerability data rather than a matcher issue.
Steps to reproduce
grype cpe:2.3:a:gnu:ncurses:6.1:::::::*
Expected result
At least one match for CVE-2023-29491 (and any other CVEs affecting ncurses < 6.4).
Actual result
✔ Scanned for vulnerabilities [0 vulnerability matches]
├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
└── by status: 0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found
Environment
Path: /home/blinq/.cache/grype/db/6/vulnerability.db
Schema: v6.1.9
Built: 2026-08-08T06:22:53Z
From: https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.9_2026-08-08T00:20:31Z_1786170173.tar.zst
Status: valid
Confirmed persistent across a subsequent grype db update check (no new DB was available at time of retest).
Reference
CVE-2023-29491: https://nvd.nist.gov/vuln/detail/CVE-2023-29491
Affected range per NVD/Debian security tracker: ncurses before 6.4 20230408
Querying Grype directly for cpe:2.3:a:gnu:ncurses:6.1:::::::* returns zero vulnerability matches, despite CVE-2023-29491 (NVD, CVSS 3.1 7.8 High) explicitly listing ncurses before 6.4 20230408 as affected — which includes version 6.1.
This CVE was previously matching correctly in earlier DB builds and disappeared from scan results as of the DB build below. Direct CPE query bypasses SBOM/scan-pipeline matching logic entirely, so this points to a gap in the underlying vulnerability data rather than a matcher issue.
Steps to reproduce
grype cpe:2.3:a:gnu:ncurses:6.1:::::::*
Expected result
At least one match for CVE-2023-29491 (and any other CVEs affecting ncurses < 6.4).
Actual result
✔ Scanned for vulnerabilities [0 vulnerability matches]
├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
└── by status: 0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found
Environment
Path: /home/blinq/.cache/grype/db/6/vulnerability.db
Schema: v6.1.9
Built: 2026-08-08T06:22:53Z
From: https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.9_2026-08-08T00:20:31Z_1786170173.tar.zst
Status: valid
Confirmed persistent across a subsequent grype db update check (no new DB was available at time of retest).
Reference
CVE-2023-29491: https://nvd.nist.gov/vuln/detail/CVE-2023-29491
Affected range per NVD/Debian security tracker: ncurses before 6.4 20230408