Grype "discovered vulnerabilities at or above the severity threshold" in CI

By Daniel Zoghalchali·Latchkey

Grype prints its findings table, then fails because you passed --fail-on high (or critical) and at least one matched. The message "discovered vulnerabilities at or above the severity threshold" means the gate is doing its job; the image has qualifying CVEs.

What this error means

Grype lists vulnerabilities and ends with "1 error occurred ... discovered vulnerabilities at or above the severity threshold", exiting 1 and stopping the pipeline.

NAME     INSTALLED  FIXED-IN  TYPE  VULNERABILITY   SEVERITY
libssl3  3.0.11-1   3.0.13-1  deb   CVE-2024-XXXX   Critical
1 error occurred:
	* discovered vulnerabilities at or above the severity threshold

Common causes

Findings match your --fail-on level

You set grype myimage --fail-on high, and the image has HIGH or CRITICAL CVEs, so Grype exits non-zero as configured.

Unfixed base-image CVEs count toward the gate

By default Grype includes vulnerabilities without a fix; those can trip the threshold even though you cannot patch them.

How to fix it

Remediate the packages Grype lists, then rescan

1. Read the FIXED-IN column and bump the base image or packages.
2. Re-run Grype to confirm the qualifying findings clear.
3. Keep --fail-on high so new HIGH/CRITICAL CVEs still block.

grype myimage:latest --fail-on high

Ignore only unfixed or reviewed CVEs

Use --only-fixed to focus on remediable findings, and a .grype.yaml ignore list (with a reason) for specific reviewed exceptions.

# .grype.yaml
ignore:
  - vulnerability: CVE-2024-XXXX
    reason: "no upstream fix; tracked in TICKET-123, review 2026-09-01"

How to prevent it

• Keep the base image patched so OS CVEs stay below threshold.
• Use --only-fixed so gates block on actionable CVEs.
• Record exceptions in .grype.yaml with a reason and review date.

Frequently asked questions

Related guides

References

• GitHub Actions documentation