Unable to unmarshal SBOM JSON with empty arrays (JSON schema is not consistent with the golang structure)

[bedla]

Description

Hi,
when I am doing SBOM scan I found out that some JSONs cannot be processed. They are perfectly valid against JSON schema, but go structures in cyclondx-go project does not match.
Please see detail in following issues:
CycloneDX/cyclonedx-go#236
CycloneDX/cyclonedx-go#196
Thx
Ivos

Desired Behavior

SBOM is scanned

Actual Behavior

console output is

$ docker run -v /mnt/c/Users/IvoŠmíd/Downloads/sbom:/my-temp aquasec/trivy sbom /my-temp/fail.sbom.json
2025-07-25T06:17:29Z    INFO    [vulndb] Need to update DB
2025-07-25T06:17:29Z    INFO    [vulndb] Downloading vulnerability DB...
2025-07-25T06:17:29Z    INFO    [vulndb] Downloading artifact...        repo="mirror.gcr.io/aquasec/trivy-db:2"
...
2025-07-25T06:17:34Z        INFO    [vulndb] Artifact successfully downloaded       repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-07-25T06:17:34Z    INFO    [vuln] Vulnerability scanning is enabled
2025-07-25T06:17:34Z    INFO    Detected SBOM format    format="cyclonedx-json"
2025-07-25T06:17:34Z    FATAL   Fatal error     sbom scan error: scan error: scan failed: failed analysis: SBOM decode error: failed to decode: CycloneDX decode error: CycloneDX decode error: json: cannot unmarshal object into Go struct field Metadata.metadata.tools of type []cyclonedx.Tool

Reproduction Steps

1. take sample SBOM JSON from https://github.com/CycloneDX/cyclonedx-go/issues/236
2. run `trivy sbom /my-temp/fail.sbom.json`
3. it fails
...

Target

SBOM

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

$ docker run -v /mnt/c/Users/IvoŠmíd/Downloads/sbom:/my-temp aquasec/trivy sbom --debug /my-temp/fail.
sbom.json
2025-07-25T06:20:59Z    DEBUG   No plugins loaded
2025-07-25T06:20:59Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-07-25T06:20:59Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-07-25T06:20:59Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-07-25T06:20:59Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-07-25T06:20:59Z    DEBUG   Ignore statuses statuses=[]
2025-07-25T06:20:59Z    DEBUG   [vulndb] There is no db file
2025-07-25T06:20:59Z    DEBUG   [vulndb] There is no valid metadata file        err="file open error: open /root/.cache/trivy/db/metadata.json: no such file or directory"
2025-07-25T06:20:59Z    INFO    [vulndb] Need to update DB
2025-07-25T06:20:59Z    DEBUG   [vulndb] No metadata file
2025-07-25T06:20:59Z    INFO    [vulndb] Downloading vulnerability DB...
2025-07-25T06:20:59Z    INFO    [vulndb] Downloading artifact...        repo="mirror.gcr.io/aquasec/trivy-db:2"
3.26 MiB / 67.05 MiB [--->___________________________________________________________] 4.87% ? p/s ?7.97 MiB / 67.05 MiB [------->______________________________________________________] 11.88% ? p/s ?12.66 MiB / 67.05 MiB [----------->_________________________________________________] 18.88% ? p/s ?17.39 MiB / 67.05 MiB [------------>___________________________________] 25.94% 23.54 MiB p/s ETA 2s22.09 MiB / 67.05 MiB [--------------->________________________________] 32.95% 23.54 MiB p/s ETA 1s26.78 MiB / 67.05 MiB [------------------->____________________________] 39.94% 23.54 MiB p/s ETA 1s31.52 MiB / 67.05 MiB [---------------------->_________________________] 47.01% 23.54 MiB p/s ETA 1s36.23 MiB / 67.05 MiB [------------------------->______________________] 54.04% 23.54 MiB p/s ETA 1s40.92 MiB / 67.05 MiB [----------------------------->__________________] 61.04% 23.54 MiB p/s ETA 1s44.64 MiB / 67.05 MiB [------------------------------->________________] 66.58% 23.43 MiB p/s ETA 0s49.36 MiB / 67.05 MiB [----------------------------------->____________] 73.62% 23.43 MiB p/s ETA 0s54.09 MiB / 67.05 MiB [-------------------------------------->_________] 80.67% 23.43 MiB p/s ETA 0s58.80 MiB / 67.05 MiB [------------------------------------------>_____] 87.71% 23.45 MiB p/s ETA 0s63.45 MiB / 67.05 MiB [--------------------------------------------->__] 94.63% 23.45 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 23.45 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 22.82 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 22.82 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 22.82 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 21.35 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 21.35 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 21.35 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [---------------------------------------------->] 100.00% 19.97 MiB p/s ETA 0s67.05 MiB / 67.05 MiB [-------------------------------------------------] 100.00% 15.36 MiB p/s 4.6s2025-07-25T06:21:05Z        INFO    [vulndb] Artifact successfully downloaded       repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-07-25T06:21:05Z    DEBUG   Updating database metadata...
2025-07-25T06:21:05Z    DEBUG   DB info schema=2 updated_at=2025-07-25T00:30:31.796954985Z next_update=2025-07-26T00:30:31.796954744Z downloaded_at=2025-07-25T06:21:05.025608716Z
2025-07-25T06:21:05Z    DEBUG   [pkg] Package types     types=[os library]
2025-07-25T06:21:05Z    DEBUG   [pkg] Package relationships     relationships=[unknown root workspace direct indirect]
2025-07-25T06:21:05Z    INFO    [vuln] Vulnerability scanning is enabled
2025-07-25T06:21:05Z    DEBUG   Initializing scan cache...      type="memory"
2025-07-25T06:21:05Z    INFO    Detected SBOM format    format="cyclonedx-json"
2025-07-25T06:21:05Z    DEBUG   Unmarshalling CycloneDX JSON...
2025-07-25T06:21:05Z    FATAL   Fatal error
  - sbom scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:403
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:262
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:630
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scan/service.go:166
  - SBOM decode error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/sbom.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/sbom/sbom.go:57
  - failed to decode:
    github.com/aquasecurity/trivy/pkg/sbom.Decode
        /home/runner/work/trivy/trivy/pkg/sbom/sbom.go:227
  - CycloneDX decode error:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*BOM).UnmarshalJSON
        /home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/unmarshal.go:46
  - CycloneDX decode error:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.DecodeJSON
        /home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/unmarshal.go:33
  - json: cannot unmarshal object into Go struct field Metadata.metadata.tools of type []cyclonedx.Tool

Operating System

Windows/WLS

Version

Version: 0.61.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @bedla
Thanks for your report!

As you correctly found - we use https://github.com/CycloneDX/cyclonedx-go.
so we need fixes in their library.
let's wait for their response/fix.

Regards, Dmitriy