A03: Software Supply Chain Failures

Software Supply Chain Failures occur when the components, tools, and pipelines used to build, package, and deliver an application are compromised or left unpatched. This category debuts in the OWASP Top 10:2025 and widens the earlier Vulnerable and Outdated Components entry: the risk is no longer only a dependency with a known CVE, but the entire chain around it — package registries, build servers, CI/CD credentials, container base images, and update channels. Attackers target this chain because a single compromised link is inherited by every downstream consumer, turning one intrusion into thousands.

Common Vulnerabilities:

• Using Outdated or Unsupported Components with Known CVEs (Common Vulnerabilities and Exposures)
• Relying on End-of-Life (EOL) or Unmaintained Third-Party Components
• Failure to Apply Security Patches for Libraries, Frameworks, and Runtimes
• No Inventory of Components in Use (Missing SBOM), so Exposure Cannot Be Assessed
• Compromised or Malicious Packages (Typosquatting, Dependency Confusion, Hijacked Maintainer Accounts)
• Unsecured CI/CD Pipelines with Over-Privileged Build Credentials or Unreviewed Build Scripts
• Unverified Artifacts and Updates Pulled Over Untrusted Channels
• Transitive Dependencies Nobody Reviewed or Pinned

To mitigate these risks, organizations should maintain a Software Bill of Materials (SBOM) for every deployed application, use automated dependency and container scanning (OWASP Dependency-Check, Snyk, Dependabot, Trivy), pin and verify versions rather than tracking floating tags, and require signed artifacts with verified provenance. Harden the pipeline itself — least-privilege build credentials, reviewed build configuration, isolated runners — and establish a patch process that can ship a dependency update quickly when the next critical advisory lands.