Your CSAF advisory, checked against all 43 mandatory tests — before the 24-hour clock runs out

Twelve conformance findings on one schema-valid CSAF advisory - PSIRT engineers at EU manufacturers, 24 hours from the ENISA report.

advisory.json:6   6.1.28   source_lang and lang are both "en"; a translation must differ from its source
advisory.json:19  6.1.21   revision "3" follows "1"; 1 version number(s) are missing
advisory.json:36  6.1.31   a product_version branch must name one version, but "4.2.0 and earlier" reads as a range (earlier)
advisory.json:39  6.1.2    product_id "CSAFPID-0001" is defined 2 times in this document
advisory.json:40  6.1.13   purl "northwind/[email protected]" is not a valid package URL
advisory.json:50  6.1.11   cwe.name is "Authentication Bypass" but CWE-287 is officially "Improper Authentication"
advisory.json:55  6.1.32   this flag names neither product_ids nor group_ids, so its justification applies to nothing
advisory.json:59  6.1.6    product_id "CSAFPID-0001" is listed as affected and as fixed in the same vulnerability
advisory.json:62  6.1.1    product_id "CSAFPID-0009" is used here but no full product name in the product tree defines it
advisory.json:63  6.1.29   this remediation names neither product_ids nor group_ids, so no reader can tell what to patch
advisory.json:70  6.1.9    baseScore is 9.1 but the vector computes to 9.8
advisory.json:71  6.1.9    baseSeverity is HIGH but a base score of 9.8 is CRITICAL
-- 12 finding(s) across 1 file(s) - 43 checks --

Run that file through any JSON schema validator and it passes. A schema describes shape: which keys exist, which types they hold. It says nothing about meaning, and every line above is about meaning. Each of those twelve findings comes from a mandatory test.

Why this matters on 11 September 2026

From 11 September 2026, a manufacturer placing a product with digital elements on the EU market must report an actively exploited vulnerability to ENISA and its national CSIRT within 24 hours of becoming aware of it, with a technical notification at 72 hours and a final report at 14 days. Awareness starts the clock, not a confirmed breach, and the duty covers products already on the market.

The advisory is written inside that same window, usually by one engineer, at speed - which is when a base score gets typed by hand instead of copied from the calculator.

What the specification asks for

Section 6.1 of OASIS CSAF 2.0 states 32 mandatory tests, and section 6.1.27 adds 11 profile tests that apply according to /document/category. The specification is explicit: these are the rules "which can not be tested by the schema".

• 6.1.9 - the scores must be computed from the vector, and the vector takes precedence. A base score of 9.1 against CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is wrong: that vector computes to 9.8, which is CRITICAL, not HIGH.
• 6.1.11 - the CWE must exist and be valid. CWE-287 is "Improper Authentication"; "Authentication Bypass" is not a CWE name.

Checking it where it is written

CSAF Advisory Check for CRA 2026 is a VS Code extension that runs all 43 checks on the open document, each finding a diagnostic on the line that caused it. Nothing leaves the machine: 944 CWE weaknesses from the MITRE dictionary travel inside the extension. The CVSS work is real arithmetic: scores recomputed from the vector for CVSS v2, v3.0 and v3.1.

The advisory in front of you is checked completely for free: all 43 checks, every finding, no watermark, no counter, no result withheld. A free web version runs the same engine in one page.

Conformance is not compliance: passing every check means the document is well-formed CSAF 2.0, not that you have met an obligation under the Cyber Resilience Act.

A licence changes scope and ownership: every advisory in the repository in one pass, an evidence file you keep as CSV, JSON or HTML, a CI checker written into your repository that exits non-zero before publication, and re-check on every save. $29 once, one licence key per person or team seat.