False negative: recent CISA KEV Tomcat vulnerability CVE-2025-24813 is not being detected

[dbrugman]

What happened:
When scanning container images that come with a vulnerable version of Tomcat (e.g., version 9.0.90), this vulnerability does not get detected. Note that this is a Critical vulnerability that has recently been added to the CISA Known Exploited Vulnerabilities (KEV) catalogue, so I think it's important Grype will detect this.

What you expected to happen:
I would expect this vulnerability to get detected, since that version of Tomcat is vulnerable.

How to reproduce it (as minimally and precisely as possible):
Run grype --by-cve tomcat:9.0.90-jdk8-corretto. It should detect CVE-2025-24813, since version 9.0.90 is vulnerable, but it doesn't

Anything else we need to know?:
This seem to be caused because the vulnerable library is tomcat-catalina, e.g. for version 9.0.90: https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-catalina/9.0.90

The associated GHSA, GHSA-83qj-6fr2-vhqg, also lists (correctly) org.apache.tomcat:tomcat-catalina as being impacted: GHSA-83qj-6fr2-vhqg

However, the Tomcat distribution renames this library to just catalina.jar (lib/catalina.jar). The META-INF file does have the original name Bundle-Name: tomcat-catalina, however grype doesn't recognize it as such. When I run syft against the same image as above:

syft tomcat:9.0.90-jdk8-corretto | grep catalina

The library gets detected as:

catalina 9.0.90 java-archive, instead of tomcat-catalina

However, when I run syft with json output, it does include tomcat-catalina in the purl and CPE:

syft -o json tomcat:9.0.90-jdk8-corretto | jq

Snippet of the output:

...
"name": "catalina"
...
"cpe": "cpe:2.3:a:apache:tomcat-catalina:9.0.90:*:*:*:*:*:*:*"
...
"purl": "pkg:maven/org.apache.tomcat-catalina/[email protected]"
...

I've raised a similar issue before (#1799), and have updated GHSA items before (github/advisory-database#4878), but in this case I'm not sure if this is an issue with syft/grype, or the definition in the GHSA.

Environment:

• Output of grype version: 0.91.0 (linux/amd64)
• OS (e.g: cat /etc/os-release or similar): Ubuntu 20.04.6 LTS (Focal Fossa)

[dbrugman]

I accidentally called this a false positive - it's actually a false negative. I've updated the title - FYI @wagoodman