A03:2025 — Software Supply Chain Failures
Verified by Precogs Threat Research
What are Software Supply Chain Failures (OWASP A03:2025)?
NEW in 2025. Expands the previous "Vulnerable and Outdated Components" to cover the entire software supply chain ecosystem: compromised packages, malicious code injection during build processes, tampered dependencies, vulnerable build pipelines, and unverified software distribution. Encompasses risks from dependency confusion, typosquatting, and build system compromises.
Impact
New category driven by high-profile incidents like the XZ Utils backdoor (CVE-2024-3094), SolarWinds, and Codecov attacks. Recognizes that supply chain integrity is now a top national security concern.