arXiv:2607.22140v4 Announce Type: replace Abstract: Software Bills of Materials (SBOMs) are read not only as inventories but as dependency graphs: vulnerability triage, reachability filtering and impact analysis traverse the edges an SBOM declares. We present the first population-scale study of the declared graph, over 78,612 SBOMs committed to public code (77,092 parseable). Of these, 52.9% omit the dependency-relationship field, although the NTIA minimum elements require it (42.3% once the 46.5% of files carrying the tool entry of a single generation harness are set aside), and a further 8.8% declare a graph in which most components are orphans, so for 61.7% a missing path says nothing about reachability. Scans of 11 large container images are all degenerate (91.4-98.0% orphans), through file entries. The format does not predict which documents these are; the producing tool does (eta^2 = 0.41-0.65), jointly with the ecosystem where a document describes one. CycloneDX completeness declarations appear in 0.10% of CycloneDX documents, and a widely used quality score separates the regimes only weakly. Reading such graphs closed-world, so that no declared path means unreachable, discards almost the whole inventory: under a production detector the median degenerate document would lose 96.4% of its components, which carry 29 version-confirmed known-exploited CVEs across 1,901 documents. Where graphs are informative, the veto touches 14 such CVEs across 164 documents, which measures its reach, not its correctness. On an 18-SBOM testbed scored with the KEV flag removed (EPSS retained), the veto suppressed 5 of 14 version-confirmed known-exploited instances, Log4Shell among them; reading silence as unknown restores them in this illustration. We release the scanner and the dataset.
Continue to arXiv Software Engineering →You are being forwarded in 6s — stay on this page