CSAF 2.0 Advisory Validator

CSAF 2.0 (Common Security Advisory Framework) is an OASIS standard for machine-readable security advisories. It replaces CVRF 1.2 and is increasingly required by EU procurement frameworks and referenced in the CRA's Annex I as part of expected security advisory practices. A CSAF advisory is a JSON document that describes one or more vulnerabilities, the affected products, and remediation guidance.

The CRA does not explicitly mandate CSAF 2.0 for all manufacturers, but Annex I references the expected security practices around advisory publication. CSAF 2.0 is increasingly required by public procurement frameworks (Germany's BSI requires it for products sold to the German government) and is the format used by ENISA for machine-readable vulnerability data.

A CSAF 2.0 document requires at minimum: a document section (with title, type, publisher, tracking, and distribution), a product_tree section (defining affected products), and a vulnerabilities section (with CVE ID, discovery date, disclosure date, scores, and remediations). This validator checks for all mandatory fields.

CSAF 2.0 defines five profile types: Base (csaf_base), Security Incident Response (csaf_security_incident_response), Informational Advisory (csaf_informational_advisory), Security Advisory (csaf_security_advisory), and VEX (csaf_vex — Vulnerability Exploitability eXchange). Most vulnerability disclosures use csaf_security_advisory.

CSAF 2.0 advisories should be published at a well-known location: `/.well-known/csaf/` on your domain, with a `provider-metadata.json` index file. The BSI and ENISA tooling will discover advisories via this path. CVD Portal generates and hosts your CSAF feed automatically.