CycloneDX

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard (ECMA-424) for cyber risk reduction with broad ecosystem support.

About CycloneDX

CycloneDX supports SBOM, SaaSBOM, HBOM, ML-BOM, CBOM, MBOM and OBOM. It also defines VDR, VEX and CDXA. Specs are available in JSON, XML and Protocol Buffers with extensive community tooling.

The specification is advanced by the CycloneDX Core Working Group, backed by the OWASP Foundation and the global security community.

Project Leaders

Steve Springett

Email LinkedIn

Patrick Dwyer

Jeffry Hesse

Jan Kowalleck

Matt Rutkowski

Project Information

Language

Specification

License

Apache-2.0

Corporate Supporters

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

Quick Links

Projects Chapters Corporate Supporters Events News Community Visit Store

Legal & Governance

About OWASP Impact Report 2025 Strategic Plan 2026 Board Board EU Finance & Governance Finance (all documents)Legal Staff

Socials

Slack LinkedIn GitHub X (Twitter)Mastodon Bluesky YouTube

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.