trivy "unable to decode SBOM" when scanning an SBOM in CI

By Kaveh Alemi·Latchkey

trivy tried to read the SBOM given to trivy sbom and could not decode it. The file is either a format trivy does not accept for that command, an unexpected spec version, or not a valid SBOM at all.

What this error means

trivy fails with "unable to decode SBOM" or "failed to detect SBOM format" instead of reporting vulnerabilities from the SBOM.

trivy sbom ./sbom.json
2026-06-30 FATAL Fatal error   scan error: unable to decode SBOM: failed to detect SBOM format

Common causes

A format or spec version trivy does not recognize

trivy sbom accepts CycloneDX and SPDX (JSON/XML) plus Syft JSON. A newer or older schema version, or a stripped file, fails detection.

A file that is not actually an SBOM

Passing a scan result, a config file, or a mislabeled JSON makes format detection fail immediately.

How to fix it

Regenerate in a format trivy accepts

1. Generate CycloneDX JSON or SPDX JSON, the formats trivy reads reliably.
2. Confirm the top-level fields (bomFormat/spdxVersion) are present.
3. Re-run trivy sbom on the regenerated file.

syft dir:. -o cyclonedx-json=sbom.cdx.json
trivy sbom ./sbom.cdx.json --severity HIGH,CRITICAL

Pin a trivy version that supports the spec

A very new CycloneDX or SPDX version may need a newer trivy. Upgrade trivy so its parser matches the SBOM spec you produce.

- uses: aquasecurity/trivy-action@0.28.0
  with:
    scan-type: sbom
    input: sbom.cdx.json

How to prevent it

• Standardize on CycloneDX JSON or SPDX JSON across the pipeline.
• Keep trivy current so its parser matches the SBOM spec version.
• Validate the SBOM has the expected format markers before scanning.

Frequently asked questions

Related guides

References

• GitHub Actions documentation