Vulnerability matching against SBOMs — VEX, Grype, Trivy

The SBOM is the inventory. The matcher is the system that turns the inventory into a CVE exposure report. The discipline is the same as a compiler: the SBOM is the source, the matcher is the binary, the output is a list of CVEs that the team must triage. The matcher does not know whether a CVE is reachable; it only knows that a component with a vulnerable version is present. The tool that distinguishes a match from an exploit is VEX — the Vulnerability Exploitability eXchange.

Grype and Trivy

anchore/grype is the matcher that pairs naturally with syft. Grype reads an SBOM, pulls the vulnerability database, and emits CVEs:

grype sbom:sbom.spdx.json

aquasec/trivy is the matcher that pairs with a broad CI/CD pipeline. Trivy reads an SBOM, an image, a filesystem, or a Git repository and produces a vulnerability report. The SBOM mode is the offline-capable scan:

trivy sbom sbom.spdx.json

flowchart LR
    A["SBOM"] --> B["Grype"]
    A --> C["Trivy"]
    B --> D["CVE match list"]
    C --> D
    D --> E["Triage"]
    E --> F["Patch / accept / VEX"]

Grype’s strength is the Anchore vulnerability database, curated and updated frequently. Trivy’s strength is broad ecosystem coverage; the weakness is noise — Trivy reports low-confidence matches that Grype often filters. The two matchers disagree on edge cases; the disagreement is signal.

What the matcher cannot do and VEX

A CVE match is not an exploit. A CVE match against a SBOM means “a component with this version is present in the artifact”; the match does not say whether the code path is executed, the library loaded at runtime, or the configuration disables the vulnerable feature.

VEX — the Vulnerability Exploitability eXchange — records the team’s decision per CVE. Each entry has a state field: not_affected, affected, fixed, or in_triage.

Production discipline

1. Run the matcher in CI against the attached SBOM on every build. The match is a property of the artifact.
2. Use two matchers and reconcile (Grype and Trivy disagree on edge cases) and refresh the matcher database on a schedule.
3. Triage the match list, produce a VEX document, and publish it as an attestation. The match is not the decision.

Cross-course references

• Git, CI/CD & GitOps — Part LXVIII-04 (SBOM Distribution and Attestation) is the durable binding that lets the matcher run against the SBOM at the deployed digest.

Quiz