How SCA False Positives Happen
Incorrect PURL matching: When a component cannot be uniquely identified (because a PURL is missing or malformed), scanners may match it to a similar but different package with known CVEs. A package named 'utils' in your private registry might be mistakenly matched to a different public package named 'utils' with vulnerabilities.
Test and dev dependency inclusion: Many build tools surface test frameworks and development tools in dependency manifests even though they are never included in production builds. If your scanner analyzes the full manifest rather than the resolved production dependency set, it will report vulnerabilities in test-only packages you never ship.
Platform and OS mismatch: CVEs for Windows-specific vulnerabilities in cross-platform packages will appear even when your application runs exclusively on Linux. NVD CVE entries often lack the platform specificity needed to automatically filter these out.
Managing False Positives with VEX
VEX (Vulnerability Exploitability eXchange) was designed to address false positives at the producer side — allowing vendors to assert that a CVE is "not affected" in their specific product with an explanation. For internal security programs, VEX-style suppression records serve the same purpose: documenting why a specific CVE in a specific component is not exploitable in your specific application, with a rationale that can be reviewed and updated when the status changes.
Building a Suppression Governance Process
Effective false positive management requires a process: a structured way to review candidate suppressions, document the rationale (which of the standard reasons applies: not in production, not reachable, different platform, etc.), set an expiry on suppression (so that suppressions are reviewed periodically rather than being permanent), and audit the suppression list. Without governance, suppression lists grow unchecked and real vulnerabilities get hidden alongside false ones.
Fewer False Positives, More Signal with Fossity
Fossity — Fossity's vulnerability engine combines CVSS scoring, EPSS exploitation probability, reachability analysis, and VEX-based suppression to deliver a vulnerability queue that reflects real risk — not scanner noise. Spend your security team's time on real issues.
Visit Fossity.com →