False negative: trivy sbom misses 278 CVEs on Syft CycloneDX that trivy image finds on the same nginx:1.25 tar (13 CRITICAL, 63 HIGH)

[GautamTalksDev]

IDs

CVE-2023-45853, CVE-2024-37371, CVE-2024-45491, CVE-2024-45492, CVE-2025-0838, CVE-2026-33845, CVE-2026-42010, CVE-2026-8376

Description

Scanning nginx:1.25 with trivy image reports 409 unique CVEs. Scanning a
Syft-generated CycloneDX SBOM of that same image tar with trivy sbom reports
137. The 278 missing include 13 CRITICAL and 63 HIGH.

The mechanism was explained by @DmitriyLewen in discussion #7850 (Nov 2024) for
Alpine: Trivy reads aquasecurity:trivy:SrcName from CycloneDX properties,
Syft writes the source package into the PURL upstream= qualifier instead, and
without the property SrcName falls back to the binary package name. Debian
advisories are keyed on source packages, so matching fails.

Nothing here is new about the cause. What I have is the effect size on Debian
images, measured on current releases, with a control group and an intervention
that confirms the mechanism.

Note that Trivy is not dropping packages: the log shows pkg_num=149 and
correct OS detection (debian 12.5). All 149 packages are read. Every one of
them resolves its source name to its binary name.

Severity of the 278 missed CVEs (unique IDs, from trivy image on the same tar):

Severity	Count
CRITICAL	13
HIGH	63
MEDIUM	121
LOW	70
UNKNOWN	11

Image digest: sha256:a484819eb60211f5299034ac80f6a681b06f89e65866ce91f356ed7c72af059c
Reproduced 2026-08-24 on a freshly pulled image.

Reproduction Steps

1. docker pull nginx:1.25 && docker save nginx:1.25 -o nginx.tar
2. syft scan docker-archive:nginx.tar -o cyclonedx-json=nginx.cdx.json
3. trivy sbom nginx.cdx.json --format json | jq -r '[.Results[]?.Vulnerabilities[]?.VulnerabilityID]|unique|length'
   Observed: 137
4. trivy image --input nginx.tar --format json | jq -r '[.Results[]?.Vulnerabilities[]?.VulnerabilityID]|unique|length'
   Observed: 409
5. Copy the source package Syft already recorded into the property Trivy reads:
   jq '.components |= map(if .properties then . + {properties: (.properties + [
       {name:"aquasecurity:trivy:SrcName",
        value:((.properties[]?|select(.name=="syft:metadata:source")|.value) // .name)},
       {name:"aquasecurity:trivy:SrcVersion", value:.version}])} else . end)' \
     nginx.cdx.json > nginx-src.cdx.json
6. trivy sbom nginx-src.cdx.json --format json | jq -r '[.Results[]?.Vulnerabilities[]?.VulnerabilityID]|unique|length'
   Observed: 415

Target

SBOM

Scanner

Vulnerability

Target OS

Debian 12

Debug Output

2026-08-24T18:30:29-04:00  DEBUG  DB info schema=2 updated_at=2026-08-24T00:58:29Z downloaded_at=2026-08-24T06:50:13Z
2026-08-24T18:30:29-04:00  INFO   [vuln] Vulnerability scanning is enabled
2026-08-24T18:30:29-04:00  INFO   Detected SBOM format    format="cyclonedx-json"
2026-08-24T18:30:29-04:00  DEBUG  Unmarshalling CycloneDX JSON...
2026-08-24T18:30:29-04:00  WARN   Third-party SBOM may lead to inaccurate vulnerability detection
2026-08-24T18:30:29-04:00  INFO   Detected OS     family="debian" version="12.5"
2026-08-24T18:30:29-04:00  INFO   [debian] Detecting vulnerabilities...  os_version="12"  pkg_num=149
2026-08-24T18:30:29-04:00  INFO   Number of language-specific files  num=1
2026-08-24T18:30:29-04:00  INFO   [jar] Detecting vulnerabilities...
2026-08-24T18:30:29-04:00  DEBUG  [vex] VEX filtering is disabled

Report Summary

  Target: nginx-1.25.cdx.json (debian 12.5)   Type: debian   Vulnerabilities: 137
  Target: Java                                Type: jar      Vulnerabilities: 0

### Version

```bash
Version: 0.72.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-08-24 00:58:29.990132025 +0000 UTC
  NextUpdate: 2026-08-25 00:58:29.990131774 +0000 UTC
  DownloadedAt: 2026-08-24 06:50:13.157825329 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2026-08-24 01:07:04.599776272 +0000 UTC
  NextUpdate: 2026-08-27 01:07:04.599776152 +0000 UTC
  DownloadedAt: 2026-08-24 07:00:25.559842448 +0000 UTC

### Checklist

- [X] Read [the documentation regarding wrong detection](https://trivy.dev/docs/latest/community/contribute/discussion/#false-detection)
- [X] Ran Trivy with `-f json` that shows data sources and confirmed that the security advisory in data sources was correct

[GautamTalksDev]

One clarification on the 278, since the two numbers in the post do not
subtract to each other and I should have said why.

278 is the size of the set difference, IDs present in the trivy image
result and absent from the trivy sbom result. It is not 409 - 137, which
is 272. The gap is 6 IDs that go the other way:

IDs in image and not in sbom    278
IDs in sbom and not in image      6
409 - 137                       272   (= 278 - 6)

The severity breakdown in the post is over the 278 set and is unchanged.

The 6 are worth noting on their own, because they mean neither result is
a superset of the other. All 6 are reported against
nginx@1.25.5-1~bookworm on the SBOM path and appear under no ID in the
image scan on this tar and DB snapshot:

CVE-2009-4487   LOW       affected
CVE-2013-0337   LOW       will_not_fix
CVE-2023-44487  LOW       affected
CVE-2026-42533  HIGH      affected
CVE-2026-56434  MEDIUM    affected
CVE-2026-60005  HIGH      affected

That is also why step 6 lands on 415 rather than 409: after the SrcName
copy the SBOM result is exactly the union of the two sets, 409 + 6.

Happy to publish both ID lists if that is useful.