A03: Software Supply Chain Failures
A03:2025 Software Supply Chain Failures is an expansion of 2021's *Vulnerable and Outdated Components*, widened to the whole ecosystem: dependencies, build systems and distribution infrastructure. It covers breakdowns or compromises in building, distributing or updating software — not only components with known CVEs.
Why it is like this
The 2021 category assumed the danger was a dependency with a published vulnerability. The attacks that followed came through build pipelines, maintainer accounts and update channels, none of which that framing reached.
Not to be confused with
A dependency-scanning problem. The category explicitly includes your CI/CD pipeline being less protected than what it builds, and the absence of separation of duty — no one person should move code to production without another human involved.
In practice
It was overwhelmingly voted a top concern in the community survey while having limited presence in the data — the fewest occurrences of any category, but the highest average exploit and impact scores from its CVEs.
Source: OWASP Top 10:2025 — A03:2025 Software Supply Chain Failures. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Predict Check yourself
Your SCA tool reports zero vulnerable dependencies. How much of A03 does that cover?
Show the answer
A fraction — the category spans build systems, distribution infrastructure, pipeline hardening and separation of duty, none of which a dependency scan sees.
The widening from "vulnerable components" to "supply chain" is the whole change, and a clean SCA report is exactly the false comfort it was meant to address.