Nil pointer while parsing sbom without `metadata.component` #9558

eruvanos · 2025-09-30T17:12:51Z

eruvanos
Sep 30, 2025

Description

Scanning an SBOM file without metadata.component results in a panic.

Desired Behavior

Scan the sbom and provide a result

Actual Behavior

Error message:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x10 pc=0x103c52bc8]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalComponent(0x1400111a308, 0x0)
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:114 +0x28
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalRoot(0x1400111a308)
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:110 +0x30
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).Marshal(0x1400111a308, {0x1066b22c0, 0x1400057ce70}, 0x109838dc0?)
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:78 +0x1dc
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalReport(_, {_, _}, {0x2, {0xc22f214af5fb2ef0, 0x3da721e, 0x109838dc0}, {0x16f3035d0, 0x18}, {0x10450077d, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:65 +0xc8
github.com/aquasecurity/trivy/pkg/report/cyclonedx.Writer.Write({{_, _}, _, {{_, _}, _, _, _}}, {_, _}, ...)
	/home/runner/work/trivy/trivy/pkg/report/cyclonedx/cyclonedx.go:31 +0x7c
github.com/aquasecurity/trivy/pkg/report.Write({_, _}, {0x2, {0xc22f214af5fb2ef0, 0x3da721e, 0x109838dc0}, {0x16f3035d0, 0x18}, {0x10450077d, 0x9}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/report/writer.go:111 +0x944
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Report(_, {_, _}, {{{0x104508f90, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:306 +0x84
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x104508f90, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14000fc2b10, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:449 +0x960
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x104508f90, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14000fc2b10, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:396 +0x1d8
github.com/aquasecurity/trivy/pkg/commands.NewSBOMCommand.func2(0x14000a3f508, {0x14000e80c80, 0x1, 0x8})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:1217 +0x190
github.com/spf13/cobra.(*Command).execute(0x14000a3f508, {0x14000e80c00, 0x8, 0x8})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0x7d4
github.com/spf13/cobra.(*Command).ExecuteC(0x14001018008)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x350
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
github.com/spf13/cobra.(*Command).ExecuteContext(...)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1064
github.com/aquasecurity/trivy/pkg/commands.Run({0x1066b25d0, 0x14000fd88c0})
	/home/runner/work/trivy/trivy/pkg/commands/run.go:23 +0x5c
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:50 +0x14c
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x20

Reproduction Steps

1. parse sbom file

`trivy sbom --scanners vuln --format cyclonedx --output report.json -d ../2.4.0-f604f77.dx.json`


{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "metadata": {
  }
}



### Target

SBOM

### Scanner

Vulnerability

### Output Format

CycloneDX

### Mode

Standalone

### Debug Output

```bash
> trivy sbom --scanners vuln --format cyclonedx -d ../sbom.dx.json --debug

2025-09-30T19:10:11+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-09-30T19:10:11+02:00	DEBUG	Cache dir	dir="/Users/VWK0I65/Library/Caches/trivy"
2025-09-30T19:10:11+02:00	DEBUG	Cache dir	dir="/Users/VWK0I65/Library/Caches/trivy"
2025-09-30T19:10:11+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-09-30T19:10:11+02:00	DEBUG	Ignore statuses	statuses=[]
2025-09-30T19:10:11+02:00	DEBUG	DB update was skipped because the local DB is the latest
2025-09-30T19:10:11+02:00	DEBUG	DB info	schema=2 updated_at=2025-09-30T06:29:59.676553683Z next_update=2025-10-01T06:29:59.676553433Z downloaded_at=2025-09-30T12:10:38.484851Z
2025-09-30T19:10:11+02:00	DEBUG	[pkg] Package types	types=[os library]
2025-09-30T19:10:11+02:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-09-30T19:10:11+02:00	INFO	[vuln] Vulnerability scanning is enabled
2025-09-30T19:10:11+02:00	DEBUG	Initializing scan cache...	type="memory"
2025-09-30T19:10:11+02:00	INFO	Detected SBOM format	format="cyclonedx-json"
2025-09-30T19:10:11+02:00	DEBUG	[notification] Running version check
2025-09-30T19:10:11+02:00	DEBUG	Unmarshalling CycloneDX JSON...
2025-09-30T19:10:11+02:00	WARN	Third-party SBOM may lead to inaccurate vulnerability detection
2025-09-30T19:10:11+02:00	WARN	Recommend using Trivy to generate SBOMs
2025-09-30T19:10:11+02:00	DEBUG	[sbom] Skipping a component with an unsupported type	file_path="../2.4.0-f604f77.dx.json" name="tika-parsing-service" version="0.1.0" type="helm"
2025-09-30T19:10:11+02:00	DEBUG	OS is not detected.
2025-09-30T19:10:11+02:00	DEBUG	Detected OS: unknown
2025-09-30T19:10:11+02:00	INFO	Number of language-specific files	num=0
2025-09-30T19:10:11+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-09-30T19:10:11+02:00	DEBUG	[vex] VEX filtering is disabled
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x10 pc=0x105c9ebc8]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalComponent(0x14000fca308, 0x0)
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:114 +0x28
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalRoot(0x14000fca308)
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:110 +0x30
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).Marshal(0x14000fca308, {0x1086fe2c0, 0x1400061e310}, 0x10b884dc0?)
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:78 +0x1dc
github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*Marshaler).MarshalReport(_, {_, _}, {0x2, {0xc22f219cf5210f18, 0xd492f75, 0x10b884dc0}, {0x16d2b75cb, 0x18}, {0x10654c77d, ...}, ...})
	/home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/marshal.go:65 +0xc8
github.com/aquasecurity/trivy/pkg/report/cyclonedx.Writer.Write({{_, _}, _, {{_, _}, _, _, _}}, {_, _}, ...)
	/home/runner/work/trivy/trivy/pkg/report/cyclonedx/cyclonedx.go:31 +0x7c
github.com/aquasecurity/trivy/pkg/report.Write({_, _}, {0x2, {0xc22f219cf5210f18, 0xd492f75, 0x10b884dc0}, {0x16d2b75cb, 0x18}, {0x10654c77d, 0x9}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/report/writer.go:111 +0x944
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Report(_, {_, _}, {{{0x106554f90, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:306 +0x84
github.com/aquasecurity/trivy/pkg/commands/artifact.run({_, _}, {{{0x106554f90, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14000bb0060, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:449 +0x960
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x106554f90, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14000bb0060, ...}, ...}, ...}, ...)
	/home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:396 +0x1d8
github.com/aquasecurity/trivy/pkg/commands.NewSBOMCommand.func2(0x140010f3808, {0x1400060db20, 0x1, 0x7})
	/home/runner/work/trivy/trivy/pkg/commands/app.go:1217 +0x190
github.com/spf13/cobra.(*Command).execute(0x140010f3808, {0x1400060dab0, 0x7, 0x7})
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0x7d4
github.com/spf13/cobra.(*Command).ExecuteC(0x14000720f08)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x350
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
github.com/spf13/cobra.(*Command).ExecuteContext(...)
	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1064
github.com/aquasecurity/trivy/pkg/commands.Run({0x1086fe5d0, 0x1400067e600})
	/home/runner/work/trivy/trivy/pkg/commands/run.go:23 +0x5c
main.run()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:50 +0x14c
main.main()
	/home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x20

Operating System

macOS Sequoia/ AWS Linux Lambda

Version

Version: 0.67.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-09-30 06:29:59.676553683 +0000 UTC
  NextUpdate: 2025-10-01 06:29:59.676553433 +0000 UTC
  DownloadedAt: 2025-09-30 12:10:38.484851 +0000 UTC

Checklist

Run trivy clean --all
Read the troubleshooting

DmitriyLewen · 2025-10-01T05:01:58Z

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Nil pointer while parsing sbom without `metadata.component` #9558

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Nil pointer while parsing sbom without metadata.component #9558

Uh oh!

eruvanos Sep 30, 2025

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Operating System

Version

Checklist

Replies: 1 comment

Uh oh!

DmitriyLewen Oct 1, 2025 Maintainer

Nil pointer while parsing sbom without `metadata.component` #9558

eruvanos
Sep 30, 2025

DmitriyLewen
Oct 1, 2025
Maintainer