False Negative: CVE-2025-53506

[bennypi]

Vulnerability ID:
GHSA-25xr-qj8w-c4vf
https://nvd.nist.gov/vuln/detail/CVE-2025-53506

Package URL or steps to reproduce:
Download tomcat-embed-core 10.1.42 from maven central: https://repo1.maven.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/10.1.42/tomcat-embed-core-10.1.42.jar

Run grype tomcat-embed-core-10.1.42.jar. It shows six other CVEs, but not CVE-2025-53506.

Anything else we need to know?:
There seems to be conflicting data if the CVE applies to tomcat-embed-core: The GHSA page says that org.apache.tomcat:tomcat-coyote is affected. mvnrepository also does not list the CVE, it is only listed on the coyote artifact.

But according to grype's db search command, the CVE should also apply to tomcat-embed-core:

grype db search CVE-2025-53506 | grep cpe
CVE-2025-53506  cpe:2.3:a:apache:tomcat-coyote:*:*:*:*:*:maven:*:*                       maven      nvd:cpe                               < 9.0.107 || >= 10.0.0-M1, < 10.1.43 || >= 11.0.0-M1, < 11.0.9  
CVE-2025-53506  cpe:2.3:a:apache:tomcat-embed-core:*:*:*:*:*:maven:*:*                   maven      nvd:cpe                               < 9.0.107 || >= 10.0.0-M1, < 10.1.43 || >= 11.0.0-M1, < 11.0.9  
CVE-2025-53506  cpe:2.3:a:apache:tomcat:*:*:*:*:*:maven:*:*                              maven      nvd:cpe                               < 9.0.107 || >= 10.0.0-M1, < 10.1.43 || >= 11.0.0-M1, < 11.0.9  
CVE-2025-53506  cpe:2.3:a:org.apache.tomcat.embed:tomcat-embed-core:*:*:*:*:*:maven:*:*  maven      nvd:cpe                               < 9.0.107 || >= 10.0.0-M1, < 10.1.43 || >= 11.0.0-M1, < 11.0.9  
CVE-2025-53506  cpe:2.3:a:org.apache.tomcat:tomcat-coyote:*:*:*:*:*:maven:*:*            maven      nvd:cpe                               < 9.0.107 || >= 10.0.0-M1, < 10.1.43 || >= 11.0.0-M1, < 11.0.9

So my main question is, why does the db show that tomcat-embed-core 10.1.42 is affected, but the actual grype scan does not report it?

Environment:

• Output of grype version: 0.109.0
• OS (e.g: cat /etc/os-release or similar): Ubuntu 22.04.5

[kzantow]

It looks like that artifact results in a package with these CPEs and PURL:

      "cpes": [
        {
          "cpe": "cpe:2.3:a:apache:tomcat-embed-core:10.1.42:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:apache:tomcat_embed_core:10.1.42:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:apache:tomcat:10.1.42:*:*:*:*:*:*:*",
          "source": "syft-generated"
        },
        {
          "cpe": "cpe:2.3:a:apache:embed:10.1.42:*:*:*:*:*:*:*",
          "source": "syft-generated"
        }
      ],
      "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.42",

It does not actually have a CPE matching cpe:2.3:a:org.apache.tomcat.embed:tomcat-embed-core:*:*:*:*:*:maven:*:* and the PURL (the org.apache.tomcat.embed/tomcat-embed-core part) does not match the GHSA of org.apache.tomcat:tomcat-coyote. The PURL matches mvnrepository, so I think that's correct. If it is a vulnerable package, org.apache.tomcat.embed/tomcat-embed-core should be added to the GHSA.

[westonsteimel]

Yes, this comes up quite frequently with new tomcat vulns. We tell GitHub every time that Tomcat embed needs to be added when they add the others but they always forget. The nice thing is we can PR it in. Perhaps we should just automate it on our side since it has happened so many times now?

I mean we could just add it to the grype db build that if it sees any maven entries from a specific set (need to check what all of the possibilities are) always also add tomcat embed core entries

[westonsteimel]

And another reason that grype wouldn't show it even if the syf-generated cpes aligned is that CPE matching is disabled by default for ecosystems that overlap with datasets that use more precise package identifiers (ie GitHub). This leads to a huge reduction in false positives in the general case, but does also lead to some false negatives like this case when the GitHub data misses entries. The CPEs in the grype database are programatically generated by me in our enriched dataset, but really the overall goal is to rely as little as possible on CPEs going forward as there is no real way to reason about what they will be

[westonsteimel]

We are working behind the scenes in further reducing this gap by creating a unified view of the data, but that will take a while longer to get to a useable state

[westonsteimel]

github/advisory-database#7125 for the GHSA update, so hopefully they will review and merge that today sometime

[bennypi]

Thanks for the responses and explanations. I found two other CVEs with the same problem: CVE-2025-52520 and CVE-2026-24734.

With tomcat being the default webserver in spring boot applications, false negatives have quite a big impact. Is there any workaround to enable CPE mapping while GHSA apparently does not match the CVEs correctly?

[willmurphyscode]

Hi @bennypi it looks like CVE-2025-52520 has been reviewed - it has packages now. So that FN should be closed. CVE-2026-24734 is still not reviewed.