Preview
This guide is a preview. Its content may change.
Troubleshooting SBOM Imports#
When You Need Help
These are common issues when importing SBOMs (software bills of materials). With the October 2026 release, error messages became more detailed, and the range of SBOMs you can import expanded.
FAQ#
A. The import fails with an error
The error message shows the cause and what to do. For how to handle each error, see Import Specifications > Troubleshooting. The two most common causes are:
- A single SBOM contains multiple operating systems (one SBOM can contain only one OS)
- The SPDX file is output in RDF format (output it again in JSON format)
B. An SBOM whose OS can't be determined fails with an error
For an SBOM that contains OS packages but no OS information, or an SBOM for an OS that FutureVuls doesn't support, select "Ignore OS information" on the import screen to import it without the OS packages. The excluded packages aren't checked for vulnerabilities.
C. OS packages with the same name cause an error
A single server can have only one version of an OS package with a given name. Check the conflicting packages and SBOMs shown in the error.
D. Detected vulnerabilities increased after I added an Application SBOM
OS packages included in an Application SBOM are also checked for vulnerabilities (only for SBOM servers whose OS is known). This is expected behavior.
E. I want to update an SBOM
From the "SBOM" tab in Server Details, you can add, download, update, and rename SBOMs. The first time you update a Server SBOM registered through the API or by paste after the October 2026 release, the OS packages are registered again, so manually assigned CPEs and tags are not carried over.
Troubleshooting#
If this page doesn't solve your issue, contact us through the support contact form and include the tool and format you used (CycloneDX or SPDX) and any error messages.