Grype: CVEs from a stored SBOM

Security · Vulnerabilities

Not studied

Added 2026-10-29.

Problem

The Syft SBOM is stored with the release, but on its own it doesn't tell you whether the components have vulnerabilities. New CVEs appear after the release ships.

Solution

Grype is "a vulnerability scanner for container images and filesystems" that can also scan SBOMs for known vulnerabilities. Scan the stored SBOM with Grype — no rebuild and no access to the image needed. Fail on a set severity, and ignore only with a recorded reason.

Example

grype sbom:./sbom.cdx.json --fail-on high --only-fixed

.grype.yaml — an exception with a justification:

ignore:
  - vulnerability: CVE-2026-00000
    reason: "The vulnerable code is never called; revisit when the base image is updated"

--fail-on returns exit code 2 for a vulnerability of the given severity or higher; --only-fixed drops vulnerabilities that have no fix.

When to use

For every release with a stored SBOM, and again on a schedule for releases already shipped. If CI already has Trivy, decide in advance whose result blocks the release.

Source

• anchore/grype
• The --fail-on and --only-fixed flags
• Ignore rule fields

How to apply it yourself

1. Scan the SBOM of the current release.
2. Compare with the Trivy report for the same image and write down the differences.
3. Add the scan to CI with --fail-on high.
4. Mark it "Studied" after the first weekly rescan of an old release.