CVD Portal
← All tools
Free Tool

CSAF 2.0 Advisory Validator

Paste your CSAF 2.0 JSON advisory and instantly validate the structure against the OASIS CSAF 2.0 schema. Identifies missing mandatory fields, invalid values, and flags common issues that would cause rejection by automated consumers and ENISA tooling.

Last updated 29 August 2026

Key takeaways

  1. CSAF 2.0 is an OASIS standard for machine-readable security advisories that replaces CVRF 1.2.
  2. A valid CSAF 2.0 document must include document metadata, a product tree of affected items, and vulnerability remediation details.
  3. CSAF 2.0 defines five profile types, which are Base, Security Incident Response, Informational Advisory, Security Advisory, and VEX.
  4. Manufacturers publish CSAF 2.0 advisories under /.well-known/csaf/ with a provider-metadata.json index file, so ENISA tooling can discover them.
Paste CSAF 2.0 JSON

Paste your complete CSAF advisory document below

Note: This validator checks for the presence of mandatory CSAF 2.0 fields. For full schema validation, use the official OASIS JSON Schema. CVD Portal generates schema-valid CSAF 2.0 advisories automatically.

Frequently asked

What is CSAF 2.0?+

CSAF 2.0 (Common Security Advisory Framework) is an OASIS standard for machine-readable security advisories. It replaces CVRF 1.2 and is increasingly required by EU procurement frameworks and referenced in the CRA's Annex I as part of expected security advisory practices. A CSAF advisory is a JSON document that describes one or more vulnerabilities, the affected products, and remediation guidance.

Is CSAF publication required under the CRA?+

The CRA does not explicitly mandate CSAF 2.0 for all manufacturers, but Annex I references the expected security practices around advisory publication. CSAF 2.0 is increasingly required by public procurement frameworks. For example, Germany's BSI requires it for products sold to the German government. CSAF 2.0 is also the format used by ENISA for machine-readable vulnerability data.

What are the mandatory fields in a CSAF 2.0 document?+

A CSAF 2.0 document requires three main sections at minimum. The document section includes title, type, publisher, tracking, and distribution. The product_tree section defines affected products. The vulnerabilities section contains CVE ID, discovery date, disclosure date, scores, and remediations. This validator checks for all mandatory fields.

What CSAF document types exist?+

CSAF 2.0 defines five profile types: Base (csaf_base), Security Incident Response (csaf_security_incident_response), Informational Advisory (csaf_informational_advisory), Security Advisory (csaf_security_advisory), and VEX (csaf_vex - Vulnerability Exploitability eXchange). Most vulnerability disclosures use csaf_security_advisory.

Where should I publish my CSAF advisory?+

CSAF 2.0 advisories should be published at a well-known location: /.well-known/csaf/ on your domain, with a provider-metadata.json index file. The BSI and ENISA tooling will discover advisories via this path. CVD Portal generates and hosts your CSAF feed automatically.

Other free CRA tools

CVSS CalculatorCalculate CVSS 3.1 base scores for vulnerability severity assessment. Includes guidance on whether the score triggers Article 14 notification obligations under the EU Cyber Resilience Act.CVD Policy GeneratorBuild a complete, publication-ready CVD policy document using a guided five-step wizard. Configure your response timelines, CRA Article 13 and 14 obligations, and product scope, then export a finished Markdown policy you can publish immediately.security.txt GeneratorGenerate a standards-compliant security.txt file (RFC 9116) for your product or website. The EU Cyber Resilience Act names no file format, and Annex I Part II point 6 requires a contact address for reporting vulnerabilities. security.txt is the machine-readable way to publish it.CVSS 4.0 CalculatorScore a vulnerability with CVSS v4.0 using Base, Threat, and Environmental metrics. The MacroVector equivalence class displays alongside the vector so the result can be verified against the specification. A vector can be supplied in the URL to share or re-check a score.SBOM Checker and Component CVE LookupThe SBOM checker matches software components against the NVD CVE database. Paste a component list in package@version form and the tool returns one NVD search link for each component, with no upload and no account.SBOM Exposure SnapshotUpload or paste a CycloneDX, SPDX JSON document or dependency manifest to scan all declared components against the OSV.dev open vulnerability database. The scanner identifies known CVEs and security advisories with precise version matching, returning an immediate severity breakdown across Critical, High, Medium, and Low vulnerabilities alongside top exposed components. The live interactive scanner is available at /sbom-exposure with no registration required. The tool operates in-request and does not store your SBOM data on our servers. For continuous vulnerability monitoring and full CRA Annex I Part II(1) due diligence, CVD Portal integrates SBOM ingestion with automated alerting and CSAF 2.0 advisory generation.

Ready to automate your CVD programme?

CVD Portal integrates all these tools and handles your Article 13 and 14 obligations automatically.

Start your free portal →