Cross-Format Semantic Preservation in Vulnerability Exploitability Exchange: A Conformance and Round-Trip Benchmark of OpenVEX 0.2.0, CycloneDX 1.6, and CSAF 2.0

Authors

Keywords:

VEX, software supply chain, SBOM, OpenVEX, CycloneDX, CSAF, semantic interoperability, vulnerability management, conformance testing

Abstract

Background: Vulnerability Exploitability eXchange (VEX) documents communicate whether a vulnerability affects a specific software product. OpenVEX, CycloneDX, and the Common Security Advisory Framework (CSAF) encode overlapping VEX concepts, but implementers lack controlled evidence about which semantics survive translation and which validators detect malformed or incomplete statements.

References

1. Cybersecurity and Infrastructure Security Agency. Minimum Requirements for Vulnerability Exploitability eXchange (VEX). Washington, DC: CISA; 2023. https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex

2. OpenVEX Project. OpenVEX Specification, Version 0.2.0. 2023. https://github.com/openvex/spec/blob/v0.2.0/OPENVEX-SPEC.md

3. OWASP Foundation, Ecma International TC54. CycloneDX Bill of Materials Standard, Version 1.6 (ECMA-424). 2024. https://cyclonedx.org/docs/1.6/json/

4. OASIS Open. Common Security Advisory Framework Version 2.0. OASIS Standard; 2022. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html

5. Churakova Y, Ekstedt M, Schmid L. Vexed by VEX tools: consistency evaluation of container vulnerability scanners. In: Foundations and Practice of Security. Lecture Notes in Computer Science. 2026:139–156. doi:10.1007/978-3-032-20018-1_8

6. Nocera S, Romano S, Di Penta M, Francese R, Scanniello G. On the adoption of software bill of materials in open-source software projects. Journal of Systems and Software. 2025;230:112540. doi:10.1016/j.jss.2025.112540

7. Fucci D, Di Penta M, Romano S, Scanniello G. Augmenting software bills of materials with software vulnerability description: a preliminary study on GitHub. In: Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering. 2025:631–635. doi:10.1145/3696630.3728513

8. Package URL Project. Package URL Specification. https://github.com/package-url/purl-spec

9. National Institute of Standards and Technology. The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.3. NIST SP 800-126 Rev. 3. 2018. doi:10.6028/NIST.SP.800-126r3

10. McNemar Q. Note on the sampling error of the difference between correlated proportions or percentages. Psychometrika. 1947;12:153–157. doi:10.1007/BF02295996

11. Holm S. A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics. 1979;6(2):65–70. https://www.jstor.org/stable/4615733

12. JSON Schema Project. JSON Schema Validation: A Vocabulary for Structural Validation of JSON, Draft 2020-12. 2022. https://json-schema.org/draft/2020-12/json-schema-validation

Cybersecurity Advances, Volume 3, Issue 1, 2026 cover for 2026: Vulnerability Intelligence in Operational Systems.

Downloads

Published

2026-10-30

Issue

Vol. 3 No. 1 (2026): 2026: Vulnerability Intelligence in Operational Systems

Section

Articles

License

Copyright (c) 2026 The author(s)

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.