Grype

Definition

Grype is an open-source vulnerability scanner that checks container images and file systems against known vulnerability databases to identify security issues in the packages they contain. It consumes a software bill of materials, either generated internally or produced by a companion tool like Syft, and reports matched vulnerabilities with severity ratings, giving development and security teams a way to catch known risks before an image ships.

Overview

Once a team knows what packages a container image or application contains, the next question is whether any of those packages have known security vulnerabilities, and that requires continuously cross-referencing an inventory against vulnerability data that changes daily as new issues are disclosed. Grype was built specifically to answer that question quickly and locally, without requiring an artifact to be uploaded to an external service for scanning. Mechanically, Grype first builds or accepts a software bill of materials describing every package and version present in a target image, directory, or archive, using the same underlying cataloging technology as Syft. It then compares each identified package and version against a local database of known vulnerabilities, compiled from sources like the National Vulnerability Database and various Linux distribution security advisories, updated regularly so scans reflect current data. Matches are reported with severity levels and, where available, the fixed version that resolves the issue, and results can be filtered or gated by severity threshold to control what fails a pipeline. Grype is commonly used as the second half of a two-step pipeline with Syft, which generates the package inventory that Grype scans, though Grype can also generate its own inventory internally for a simpler single-tool workflow. It occupies similar ground to tools like Trivy, which combine inventory scanning and vulnerability matching in one binary; the practical difference is largely in ecosystem integration, database sourcing, and whether a team wants Syft's SBOM output reused for purposes beyond vulnerability scanning. In practice, teams run Grype as a CI/CD gate that fails a build when a container image contains a vulnerability above a configured severity threshold, preventing known-vulnerable images from reaching a registry or production. Security teams also use it for periodic scans of already-deployed images to catch newly disclosed vulnerabilities in software that was clean at build time but has since been affected by a new CVE disclosure. Like any database-driven scanner, Grype's results are only as current as its vulnerability database, and a scan run before a database update can miss a very recently disclosed issue. It also cannot detect vulnerabilities in custom, unpublished code, since it matches against known public package vulnerability records rather than performing its own code analysis, and false positives can occur when a vulnerable function exists in a package but isn't actually reachable by the application using it. Teams that rely on Grype as a hard release gate should schedule regular database refreshes and periodic re-scans of already-shipped artifacts, since a clean scan at build time offers no guarantee against a vulnerability disclosed the following week.

Key Features

• Scans container images, directories, and SBOMs against known vulnerability databases
• Reports matched CVEs with severity ratings and available fixed versions
• Configurable severity thresholds to gate CI/CD pipelines
• Can consume an SBOM generated by Syft or generate its own inventory
• Regularly updated local vulnerability database for offline-capable scanning
• Supports scanning of OS packages and language-specific dependencies
• Command-line tool suitable for automated pipeline integration
• Open-source and maintained by Anchore

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps