Failure to match vulnerabilities after upgrade to 4.14.2

### Current Behavior

I've upgrade our installation from 4.13.5 to 4.14.2 and we are now finding that some vulnerabilities that were previously matched in 4.13.5 are no longer found in 4.14.2

For example: component 'iperf3' version '3.10.1'
This should match CVE-2025-54349 (NVD) , and it did in the earlier version, but not now. It should match 3.2 < x < 3.19.1
I tried a variety of other versions to see if any would match: 3.2, 3.3, 3.3.1, 3.10 and none match either.

I have NVD and Google OSV switched on as vulnerability sources, And the Analysers are configured to use 'internal' with all 3 'fuzzy' modes switched on

### Steps to Reproduce

1. Example Bom :
[test.sbom.json](https://github.com/user-attachments/files/28352517/test.sbom.json)

2. Analyser settings:

### Expected Behavior

iperf3 v3.10.1 should have been flagged as a critical vulnerability under CVE-2025-54349

### Dependency-Track Version

4.14.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

18.4

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported