Overview
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. It lets organizations describe exactly what a product is made of — software components, services, hardware, machine learning models, cryptographic assets and their dependencies — in a machine-readable, interoperable format.
Originating in 2017 from the OWASP Dependency-Track ecosystem, CycloneDX became an OWASP flagship project in June 2021 and is now an official Ecma International standard published as ECMA-424. The latest specification is version 1.7, released on 2025-10-21.
A full-stack Bill of Materials standard that provides advanced supply chain capabilities for cyber risk reduction.
Core content
BOM types & vulnerability artifacts
- SBOM — Software Bill of Materials: inventory of software components and libraries
- SaaSBOM — describes services, endpoints, data flows and trust boundaries of SaaS
- HBOM — Hardware Bill of Materials for physical devices and components
- ML-BOM / AI-BOM — machine learning models, datasets and AI transparency
- CBOM — Cryptography Bill of Materials: cryptographic assets and algorithms
- OBOM — Operations Bill of Materials: running/operational runtime inventory
- MBOM — Manufacturing Bill of Materials for build and assembly processes
- VEX — Vulnerability Exploitability eXchange: communicates exploitability status
- VDR — Vulnerability Disclosure Report: discloses known vulnerabilities in a product
Formats & core capabilities
- Formats: JSON, XML and Protocol Buffers (protobuf)
- Component inventory with rich metadata, identifiers (PURL, CPE, SWID) and licensing
- Dependency graph capturing both direct and transitive relationships
- Pedigree and provenance — full lineage and origin of every component
- Services modeling for external APIs, endpoints and data flows
- Vulnerabilities, VEX and formulation (how a component was built/deployed)
- Digital signing and attestation for tamper-evidence and integrity
Ecosystem & tooling
CycloneDX is backed by a large ecosystem of official and community tools that generate, validate, merge and consume BOMs across languages and build systems. Generation can be automated in CI/CD pipelines and distributed through a BOM Repository Server for storage and exchange.
- cdxgen — a multi-language SBOM/BOM generator covering many ecosystems
- Language-specific generators and plugins for Maven, Gradle, npm, Python and more
- Core libraries for producing and parsing BOMs in major programming languages
- BOM Repository Server for centralized storage, distribution and exchange
- OWASP Dependency-Track natively consumes CycloneDX BOMs for continuous analysis
How it's used
CycloneDX is used to achieve software supply chain transparency, accelerate vulnerability management, enforce license compliance and meet regulatory requirements. Because a BOM enumerates every component and its provenance, teams can quickly answer questions like 'are we affected by this CVE?' or 'what cryptography are we shipping?'.
- Supply chain transparency — share a verifiable inventory with customers and auditors
- Vulnerability management — map components to CVEs and triage with VEX
- License compliance — track licenses and obligations across all dependencies
- Regulatory drivers — US Executive Order 14028 and the EU Cyber Resilience Act (CRA)
History & versions
CycloneDX traces its origins to 2017, emerging from OWASP Dependency-Track (issue #52), with the 1.0 specification released in March 2018. It joined OWASP as a flagship project in June 2021 and has since gone through multiple backward-compatible revisions adding services, vulnerabilities, formulation, AI/ML and cryptography support.
In December 2023, Ecma International chartered Technical Committee TC54 for Software & System Transparency. In June 2024, CycloneDX v1.6 was ratified as an international standard and published as ECMA-424 (1st Edition). The specification continues to advance, with v1.7 released on 2025-10-21.