CycloneDX/specification

View on GitHub

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

Stars: 551
Forks: 93
Open beginner issues: 11
Indexed issues: 183
Avg merge: 4h 51m
Merged PRs (30d): 42

Dominant language: XSLT
License: Apache-2.0
Last GitHub push: Sep 17, 2026
Latest indexed: Sep 15, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

SBOM clarifications on various usecases Open

proposed core enhancement

Difficulty 4/5 3-5 days Newbie friendliness 30/100

CycloneDX/specification#1124 · Opened Sep 22, 2026
Proposal: CycloneDX Safety Perspective for SRAC and safety impact workflows Open

cap: perspective-registry

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#1122 · Opened Sep 21, 2026
Response vs Responce Open

Difficulty 1/5 Under an hour Newbie friendliness 68/100

CycloneDX/specification#1121 · Opened Sep 21, 2026
[2.0] remove "service" from docs Open

defect documentation

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

CycloneDX/specification#1115 · Opened Sep 18, 2026
[FEATURE]: Add EAX mode to Cryptography Registry Open

cap: cryptography-registry

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

CycloneDX/specification#1098 · Opened Sep 10, 2026
[2.0] chore: annotational value examples schall be schema-compliant Open

chore

CycloneDX/specification#1094 · 1 assignee · Opened Sep 10, 2026
revisit formulations Open

cap: formulation

CycloneDX/specification#1089 · 1 comment · 1 assignee · Opened Sep 8, 2026
[2.0] docs: remove the word "BOM" Open

documentation

Difficulty 3/5 1-2 days Newbie friendliness 52/100

CycloneDX/specification#1086 · Opened Sep 7, 2026
[2.0] docs - streamline code, literals, in-text examples, referenced properties Open

CDX 2.0 documentation

CycloneDX/specification#1085 · 1 assignee · Opened Sep 7, 2026
[2.0] formulation - docs make nosense Open

cap: formulation CDX 2.0 defect

CycloneDX/specification#1083 · 1 assignee · Opened Sep 7, 2026
[2.0]: Define the certificate bytes covered by certificateProperties.fingerprint Open

proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#1081 · 3 comments · Opened Sep 4, 2026
docs tool issues for JSON produces duplicate id Open

defect documentation format: JSON

CycloneDX/specification#1076 · 1 comment · 1 assignee · Opened Sep 2, 2026
[2.0]: Definitions registry and multi-product inventory refactor Open

breaking-changes proposed core enhancement request for comment RFC notice sent

CycloneDX/specification#1072 · 2 comments · 1 assignee · Opened Aug 31, 2026
[2.0]: Proposal - Pre-defined perspectives: stable spec-provided identity with incorporation by reference Open

CDX 2.0 proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#1066 · Opened Aug 29, 2026
[2.0] Fix all the linter errors Open

CDX 2.0 defect documentation

Difficulty 4/5 3-5 days Newbie friendliness 52/100

CycloneDX/specification#1058 · 1 comment · Opened Aug 27, 2026
[Defect]: relatedCryptographicAsset.type description is copied from securedBy.mechanism Open

defect

Difficulty 1/5 Under an hour Newbie friendliness 91/100

CycloneDX/specification#1045 · 2 comments · Opened Aug 25, 2026
[2.0]: Harmonize BOM metadata authorship with the party model Open

CDX 2.0 proposed core enhancement

CycloneDX/specification#1037 · 2 comments · 1 reaction · 1 assignee · Opened Aug 21, 2026
[2.0] docs: update schema/2.0/model/README.md Open

CDX 2.0 documentation ready for review

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

CycloneDX/specification#1035 · Opened Aug 21, 2026
[2.0] spec review: must --> shall Open

CDX 2.0 defect documentation

CycloneDX/specification#1033 · 5 comments · 1 assignee · Opened Aug 20, 2026
[Defect]: LMOTS parameters and add missing HSS variant (LMS family) Open

cap: cryptography-registry defect

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

CycloneDX/specification#1028 · Opened Aug 16, 2026
[Defect]: Missing GOST 2012/2015 algorithms and curve OIDs Open

cap: cryptography-registry defect

Difficulty 3/5 1-2 days Newbie friendliness 66/100

CycloneDX/specification#1025 · Opened Aug 15, 2026
[2.0] refactor component for specificcomponent types Open

CDX 2.0

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#1024 · Opened Aug 15, 2026
Behavior evidence gap: linking agent actions back to BOM components Open

CDX 2.0

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#1016 · 9 comments · Opened Aug 10, 2026
Behavior evidence gap: linking agent actions back to BOM components Open

cap: behavior proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#1015 · 1 comment · Opened Aug 10, 2026
Discuss possibility of moving living schemas to dedicated repos Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

CycloneDX/specification#1014 · Opened Aug 9, 2026
[Defect]: Regression in the latest 2.0 schema WIP where component identifiers details are lost Open

defect

CycloneDX/specification#1008 · 1 assignee · Opened Aug 5, 2026
[2.0]: dont use non-standard modifiers in patterns Open

CDX 2.0 chore defect

CycloneDX/specification#989 · 1 assignee · Opened Jul 29, 2026
[2.0]: dont use character classes in patterns Open

CDX 2.0 chore defect

CycloneDX/specification#988 · 1 assignee · Opened Jul 29, 2026
Proposal: Add MITRE ATLAS as a named threat classification taxonomy in CycloneDX 2.0 Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

CycloneDX/specification#976 · Opened Jul 17, 2026
[CDX 2.0] test resources component choice enhancements Open

CDX 2.0 test-data

CycloneDX/specification#971 · 1 assignee · Opened Jul 6, 2026
Refactor role-based entities to use the party model Open

CycloneDX/specification#964 · 1 comment · 1 reaction · 1 assignee · Opened Jun 28, 2026
[CDX2.0]: have no "other" enums values where alternative, arbitrary strings are allowed Open

CDX 2.0 defect

Difficulty 5/5 Over a week Newbie friendliness 42/100

CycloneDX/specification#961 · 3 comments · Opened Jun 25, 2026
Proposal: Extend CycloneDX model to support hardware-software interface semantics Open

proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

CycloneDX/specification#959 · 3 comments · Opened Jun 22, 2026
# Proposal: AI Behavioral Risk Assertions for CycloneDX 2.0 Open

CycloneDX/specification#956 · 3 comments · 1 assignee · Opened Jun 19, 2026
Proposal: Safety Integrity Classification (SIC) — A Cross-Domain Normalized Abstraction for CycloneDX 2.0 Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

CycloneDX/specification#955 · 3 comments · Opened Jun 19, 2026
Proposal: Safety Relevance Metadata for CycloneDX Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#954 · 16 comments · Opened Jun 19, 2026
Consider extensible signature standards support Open

proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

CycloneDX/specification#943 · Opened Jun 1, 2026
[FEATURE]: add threat detection coverage field to AI/ML-BOM (modelCard.threatDetection) Open

cap: ai/ml

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#927 · 13 comments · Opened May 9, 2026
[Defect]: cryptographic algorithm family enum omits families defined in cryptography-defs.json Open

cap: cryptography-registry defect

Difficulty 1/5 Under an hour Newbie friendliness 86/100

CycloneDX/specification#918 · Opened May 2, 2026
[Defect]: Variant pattern for PBES1 must have {hashAlgorithm} instead of {kdf} Open

cap: cryptography-registry defect

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

CycloneDX/specification#906 · 1 comment · Opened Apr 4, 2026
[Defect]: Variant pattern for PBES2 must have {prfFunction} instead of {kdf} Open

cap: cryptography-registry defect

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

CycloneDX/specification#905 · Opened Apr 4, 2026
[Defect]: Variant pattern for PBKDF2 must have {prfFunction} instead of {hashAlgorithm} Open

cap: cryptography-registry defect

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

CycloneDX/specification#904 · 3 comments · Opened Apr 4, 2026
[Defect]: Variant pattern AES[-(128|192|256)]-Wrap[-PKCS7] unclear Open

cap: cryptography-registry defect

Difficulty 3/5 1-2 days Newbie friendliness 45/100

CycloneDX/specification#901 · 2 comments · Opened Mar 29, 2026
[FEATURE]: Patch type for component data type Open

proposed core enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

CycloneDX/specification#900 · 4 comments · Opened Mar 27, 2026
[FEATURE]: Add a proper way to represent VCS tags Open

proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

CycloneDX/specification#891 · 1 comment · Opened Mar 24, 2026
[FEATURE]: Add KEV information to vulnerablity Open

proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

CycloneDX/specification#890 · 1 comment · Opened Mar 20, 2026
[Defect]: CMAC missing key length Open

cap: cryptography-registry defect

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

CycloneDX/specification#866 · 1 comment · Opened Mar 11, 2026
[FEATURE]: Track chat templates in modelCard for ML model supply chain integrity Open

cap: ai/ml proposed core enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

CycloneDX/specification#862 · 2 comments · Opened Mar 9, 2026
[FEATURE]: Add KangarooTwelve and TurboSHAKE to Cryptography Registry Open

cap: cryptography-registry

Difficulty 2/5 1-3 hours Newbie friendliness 52/100

CycloneDX/specification#861 · 1 comment · Opened Mar 7, 2026
[FEATURE]: Add ConcatKDF to Cryptography Registry Open

cap: cryptography-registry proposed core enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

CycloneDX/specification#857 · 1 comment · Opened Mar 1, 2026

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

CycloneDX/specification

Showing the newest 100

Get new issues in your inbox