Vulnerability Scanning Fails for Maven Packages with CPEs in CycloneDX SBOM JSON

[pganaus]

Vulnerability ID:
https://nvd.nist.gov/vuln/search#/nvd/home?cpeFilterMode=cpe&cpeName=cpe:2.3:a:openssl:openssl:3.0.7:*:*:*:*:*:*:*&resultType=records

Package URL or steps to reproduce:

tldr: CycloneDX SBOM JSON scanning with cpe and pkg:maven does not work. But does work with pkg:generic.

I have a CycloneDX SBOM JSON file containing a self compiled version of OpenSSL. The OpenSSL source code is resolved via a Maven dependency and the SBOM JSON has been generated by the Gradle CycloneDX plugin. Therefore the "pkg" type is "maven". I have added a "cpe" (Common Platform Enumeration) field to the component, which should be used as identifier when the SBOM is scanned for vulnerabilities.

The issue is that no CVEs are found.

As sson as I change the "purl" field from "pkg:maven/org.openssl/openssl@3.0.7?type=gz" to "pkg:generic/org.openssl/openssl@3.0.7?type=gz" lots of vulnerabilities are found.
The scanner seems to fully rely on the "cpe" field because when I use "pkg:generic/org.openssl/openssl@3.0.7?type=gz" but no "cpe" field, no vulnerabilities are found anymore. So grype should not require the "pkg" type "generic" to allow "cpe" scanning to work.

Here is the command I use:

$ grype sbom:openssl-nt-3.0.7.100-sbom.json 
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]  
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 0 not-fixed, 0 ignored 
No vulnerabilities found

Contents of openssl-nt-3.0.7.100-sbom.json

{
    "bomFormat": "CycloneDX",
    "specVersion": "1.6",
    "serialNumber": "urn:uuid:a325a4bd-8cb9-47c8-81fa-c399a56b808f",
    "version": 1,
    "metadata": {
        "timestamp": "2026-07-21T14:43:38Z",
        "tools": {
            "components": [
                {
                    "type": "application",
                    "author": "CycloneDX",
                    "name": "cyclonedx-gradle-plugin",
                    "version": "3.3.0"
                }
            ]
        },
        "component": {
            "type": "library",
            "bom-ref": "pkg:maven/com.example.oss.openssl/openssl-nt@3.0.7.100?type=zip",
            "group": "com.example.oss.openssl",
            "name": "openssl-nt",
            "version": "3.0.7.100",
            "purl": "pkg:maven/com.example.oss.openssl/openssl-nt@3.0.7.100?type=zip",
            "modified": false,
            "externalReferences": [
                
            ]
        }
    },
    "components": [
        {
            "type": "library",
            "bom-ref": "pkg:maven/org.openssl/openssl@3.0.7?type=gz",
            "group": "org.openssl",
            "name": "openssl",
            "version": "3.0.7",
            "hashes": [
                {
                    "alg": "MD5",
                    "content": "36608cd5445f708d0c2200aea9682c35"
                },
                {
                    "alg": "SHA-1",
                    "content": "53d331880fbde8e6fe25870d5325a61201f6264d"
                },
                {
                    "alg": "SHA-256",
                    "content": "a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8"
                },
                {
                    "alg": "SHA-512",
                    "content": "de5351d2d532e1a3908a738f7d8aae448d32bc60bdb24808c556a24bc37a3f53daedf12b5d432eeb8c235e16939d842f908332ede8a447ca103ad1c493c820d7"
                },
                {
                    "alg": "SHA-384",
                    "content": "30b6e9317523927bc670481176fb5efeeddeb9644680a5b9cb36013af90952f48b4d07dda0c620fc9eab37cb3b0ffc47"
                },
                {
                    "alg": "SHA3-384",
                    "content": "c8afc068de3247ab9a6a142a9f4f749f4033266a0e70009afa7a50621285e4d3f5e75c8e3c73195fd2d89dfc5f9f544d"
                },
                {
                    "alg": "SHA3-256",
                    "content": "b57ec02982de0b59e5c6c9d22d6462b4deed4aadea3ff334d2ba34c4e97a4152"
                },
                {
                    "alg": "SHA3-512",
                    "content": "40666b53a0220253f53d0aad8bf962819f541039acaeca39b9bcfa2f1f7258c8de6df2cab2bb5822b1237571760b5cc0cce04a6c8c131a21f1f19e3a0d0ae0fb"
                }
            ],
            "licenses": [
                {
                    "license": {
                        "id": "Apache-2.0",
                        "url": "https://www.apache.org/licenses/LICENSE-2.0"
                    }
                }
            ],
            "purl": "pkg:maven/org.openssl/openssl@3.0.7?type=gz",
            "modified": false,
            "properties": [
                {
                    "name": "cdx:maven:package:test",
                    "value": "false"
                }
            ],
            "cpe": "cpe:2.3:a:openssl:openssl:3.0.7:*:*:*:*:*:*:*",
            "externalReferences": [
                
            ]
        }
    ],
    "dependencies": [
        {
            "ref": "pkg:maven/com.example.oss.openssl/openssl-nt@3.0.7.100?type=zip",
            "dependsOn": [
                "pkg:maven/org.openssl/openssl@3.0.7?type=gz"
            ]
        },
        {
            "ref": "pkg:maven/org.openssl/openssl@3.0.7?type=gz",
            "dependsOn": [
                
            ]
        }
    ]
}

Environment:

• Output of grype version:

$ grype version
Application:         grype
Version:             0.116.0
BuildDate:           2026-07-16T16:02:15Z
GitCommit:           Homebrew
GitDescription:      [not provided]
Platform:            darwin/arm64
GoVersion:           go1.26.5
Compiler:            gc
Syft Version:        v1.48.0
Supported DB Schema: 6

• OS (e.g: cat /etc/os-release or similar):
  macOS Version 26.5.2 (25F84)