Research
Three SBOM Generators Diverge Systematically on 3,000 Projects, 14 Months Before the CRA Makes SBOMs Mandatory
arXiv 2609.19920 (17 Sep 2026) evaluates three widely used SBOM generators across more than 3,000 JavaScript and Rust projects against a ground truth derived from dependency lockfiles, and finds the tools disagree on both dependency coverage and SBOM completeness. The discrepancies are mostly systematic rather than buggy, tracing to different assumptions about dependency scope, naming, provenance and representation plus inconsistent support for spec-defined fields. With SBOMs becoming mandatory under the EU Cyber Resilience Act in December 2027, the authors' point is that tool choice alone can decide compliance, and no amount of bug fixing closes a gap that the specification itself leaves open.
↳ Follow the thread