FDA-VULN-001 warning

Known vulnerabilities are identified, including CISA KEV entries

Pack fda-524b 1.0.0

Severity: warning
This is the rule that addresses the deficiency actually being issued. Published reviews of real deficiency letters describe reviewers cross-referencing the submitted SBOM against public vulnerability databases and citing CVEs the sponsor did not disclose. A conformance-only checker does not catch this; packages/vulnmatch does.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Identify every known vulnerability for the device and its components, including anything in CISA's Known Exploited Vulnerabilities Catalog. For each one, describe how it was found, give a safety and security risk assessment, and describe the risk controls, including any compensating controls.
Source: fda-premarket-2026-02: Section V.A.4(b), known vulnerabilities paragraph
Note: THE HIGHEST-VALUE RULE IN THIS PACK. The presence check here is weak on its own; it exists so the finding has an anchor. The real work is done by the matching layer in section 6A, which finds the advisories the file failed to declare.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-VULN-001 --pack fda-524b prints this page.