Cross-Format Semantic Preservation in Vulnerability Exploitability Exchange: A Conformance and Round-Trip Benchmark of OpenVEX 0.2.0, CycloneDX 1.6, and CSAF 2.0

Abstract

Background: Vulnerability Exploitability eXchange (VEX) documents communicate whether a vulnerability affects a specific software product. OpenVEX, CycloneDX, and the Common Security Advisory Framework (CSAF) encode overlapping VEX concepts, but implementers lack controlled evidence about which semantics survive translation and which validators detect malformed or incomplete statements.

Methods: We prospectively specified and executed a protocol-frozen standards-level conformance benchmark using 96 deterministic synthetic VEX vectors. The corpus crossed four statuses, five `not_affected` justifications, Package URL and Common Platform Enumeration identifiers, one- and two-product scopes, and compact or enriched optional metadata. Reference adapters serialized each vector as OpenVEX 0.2.0, CycloneDX 1.6, and CSAF 2.0, then performed all six ordered cross-format translations. Thirteen semantic fields were scored as exact, controlled-equivalent, text-only, or lost. Positive documents were evaluated with frozen normative schemas and maintained tools. Twelve seeded negative vectors per format tested structural, referential, enumerated-value, and conditional constraints. Prespecified field-instance rates were supplemented by transparently labeled exploratory cluster-bootstrap intervals and paired exact comparisons.

Results: All 288 positive serializations passed their applicable maintained parser, schema, and strict mandatory-validation layers. Across 880 applicable field instances, direct machine-readable retention was 100.0% for OpenVEX, 89.09% for CSAF (exploratory 95% cluster-bootstrap interval 88.45–89.15%), and 67.27% for CycloneDX (66.47–69.21%). CycloneDX lost document and statement identifiers, retained only 56.2% of justifications in controlled form, and retained 15.6% of impact statements in machine-readable form under the frozen mapping. CSAF lost statement identifiers but preserved controlled justification flags. Negative-vector detection ranged from 0/12 for the tested CycloneDX CLI invocation and 1/12 for the OpenVEX parser path to 11/12 for Secvisogram strict mandatory validation. Median compact document sizes were 723, 740, and 1,270 bytes for OpenVEX, CycloneDX, and CSAF, respectively.

Conclusions: A syntactically accepted VEX document is not necessarily semantically interchangeable or complete. Translation gateways should publish field-level loss reports, preserve source documents, distinguish controlled mappings from free-text fallback, and apply profile-aware validation in addition to parser or schema acceptance.