A03:2025 Software Supply Chain Failures extends the 2021 category on vulnerable and outdated components to cover the wider software ecosystem. It sits third in the 2025 OWASP Top 10. Testing for it starts with a complete, current inventory of what your software is built from.
What changed from the 2021 category
The 2021 entry was about using components with known vulnerabilities or no support. The OWASP 2025 introduction says A03 now covers the wider ecosystem. The text also names A03 as one of the categories that community survey respondents voted for, which suggests practitioners felt the risk was larger than automated testing data showed.
The category is small by CWE count. The introduction lists A03 and A09 as the smallest, at five CWEs each. The risk is broad even if the weakness list is short.
Why inventory comes first
You cannot judge a supply chain you cannot see. Three questions come before any scanning result:
- What direct and transitive dependencies does each application use?
- Which versions are deployed, not just declared?
- Where did each component come from?
A software bill of materials answers the first two. Provenance information, where available, helps with the third. Without them, a scan only tells you about what the scanner happened to find.
What a good test looks like
- Coverage: does the tool read lockfiles and manifests for every ecosystem you use?
- Freshness: how quickly do new advisories reach your results?
- Context: does it tell you whether a vulnerable function is reachable from your code?
- Action: does it show a fixed version, and can it open the change for you?
- Memory: does it keep checking after the first scan?
The OWASP data pipeline itself used CVE data extracted from OWASP Dependency Check to score exploit and impact, which shows how central vulnerability records are to this category. Records alone do not tell you whether you are affected.
Common gaps in practice
Teams that score well on scanning still miss supply chain risk in three places.
First, build time versus run time. A lockfile says what you meant to install. The container image or deployed artifact says what is running. They drift, and the OWASP category is about what actually ships.
Second, ownership. A finding in a transitive dependency often has no obvious owner. Decide ahead of time who triages those, or they sit open for months.
Third, change control. New dependencies arrive in pull requests. A gate at that point is cheaper than a cleanup later. Our post on evaluating pull request gates compares block, warn and observe modes.
None of this needs a new framework. It needs an inventory, an owner and a rule about what may enter the build.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a direct dependency pulls in transitive ones you never chose.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning and reachability analysis, and the free scan at gold.safeguard.sh/scan shows an inventory for a repository you point it at.
Quick check
Is A03 only about known vulnerable libraries?
No. According to OWASP, it extends the 2021 vulnerable and outdated components category to the wider software ecosystem.
Sources
Last reviewed: 19 October 2026.
