Common Security Advisory Framework (CSAF)

The Common Security Advisory Framework (CSAF) is an OASIS open standard (CSAF 2.0, published 2022) that defines a JSON-based format for machine-readable security advisories. CSAF advisories contain structured data about vulnerabilities — CVE IDs, CVSS scores, affected products (using CPE or PURL identifiers), remediation status, and fix availability — enabling downstream tools to automate vulnerability correlation and patch management. CSAF supersedes the older CVRF (Common Vulnerability Reporting Framework) XML format. CSAF also defines distribution requirements: advisories must be published at a standardised URL path and listed in a CSAF provider-metadata.json index.

The CRA requires manufacturers to publish security advisories when releasing patches (Annex I Part II), but does not mandate CSAF by name. ENISA's published guidance strongly recommends CSAF as the format for CRA-compliant advisories. Key reasons:

• Machine-readability — CSAF enables customers' vulnerability management tools to automatically ingest advisory data without manual parsing.
• VEX support — CSAF supports VEX (Vulnerability Exploitability eXchange) documents, allowing manufacturers to assert which CVEs do and do not affect specific product versions.
• CSIRT compatibility — national CSIRTs that manufacturers must notify under Article 14 are increasingly CSAF-native and expect structured data.
• Regulatory auditing — a structured, versioned CSAF archive provides an audit trail of vulnerability handling activity.

A CSAF advisory publication workflow for a CRA-obligated manufacturer:

1. Draft — author the advisory in CSAF JSON format, including document metadata, product tree (affected products and versions), vulnerability records (CVE, CVSS, CWE), and remediation entries.
2. Validate — use the CSAF validator tool (open-source, from BSI / OASIS) to check schema conformance and business rule compliance.
3. Sign — sign the advisory document and its SHA-256/SHA-512 hash files.
4. Publish — upload to /.well-known/csaf/ on your advisory distribution domain alongside an updated provider-metadata.json and aggregator-accessible index.
5. Notify — reference the CSAF advisory URL in ENISA/CSIRT notifications required by Article 14.

CSAF 2.0 defines six profiles for different advisory types:

• CSAF Base — minimal required fields only.
• Security Advisory — the standard profile for disclosing fixed vulnerabilities.
• VEX — for asserting exploitability status without remediation information.
• CSAF Informational Advisory — non-security product notices.

For CRA compliance, manufacturers will primarily use the Security Advisory and VEX profiles. VEX is particularly valuable for communicating which CVEs in shared upstream components do not affect your specific product build, reducing unnecessary customer patch workloads.