When an SBOM points to another SBOM, fetch the referenced document, check that it is the right one by identifier or checksum, then link it to the parent record without merging away its origin. Keep every link visible so a vulnerability can be traced up to the product you received.
Why SBOMs link to each other
Software is assembled from parts that have their own makers. A supplier may ship a product built from a library or sub-product whose maker publishes its own bill of materials. Rather than copy that content, the parent file references it. Both major formats support this.
- CycloneDX external references have a type value for a bill of materials, described as covering an SBOM, OBOM, HBOM, SaaSBOM and similar.
- SPDX 2.3 has External Document References. Each entry has a
DocumentRef-identifier, the referenced document's URI and a checksum.
The checks before you follow a link
- Is the link reachable and allowed? Only fetch from sources you are comfortable contacting. A link inside a file is untrusted input.
- Does it match? SPDX gives you a checksum. Compare it. For CycloneDX, look for a hash on the reference or compare the serial number and version of what you fetched.
- Is it current? CycloneDX says a BOM should have a serial number, and when several BOMs share one, consumers should use the highest version.
- Is the format one you accept? Run the same validation you apply to top level files.
How to store the chain
Keep a parent and child relationship in your database rather than flattening everything into one list. A flat list loses the answer to a question you will be asked: which product did this component come in through? A graph keeps that answer.
| Approach | Good | Bad |
|---|---|---|
| Flatten into one list | Simple queries | Loses origin and ownership |
| Keep documents separate, link by ID | Preserves provenance | Needs a resolver |
| Hybrid: index components, keep links | Fast search, traceable | More design work |
The hybrid option works best in practice.
When the link is dead
Mark the child as unresolved. Do not fill in a guess. Ask the supplier for a current location or an attached copy. Tell them which product and release you were reviewing.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how direct and indirect dependencies are shown together, then picture each indirect one as a separate linked document.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, including transitive dependencies in the code you scan. You can run the free scan on a project to see the full dependency tree.
Quick check
Should I merge referenced SBOMs into the parent?
Prefer linking and indexing. Merging loses origin, and origin decides who you ask when a component is vulnerable.
Is a link inside an SBOM safe to follow automatically?
Treat it as untrusted. Limit which hosts your resolver contacts and verify the checksum or identifier after download.
Sources
- CycloneDX 1.6 JSON reference: external reference type for BOMs, serial number and version guidance.
- SPDX 2.3.1, document creation information: external document references and checksum.
Last reviewed: 19 October 2026.
