CycloneDX Maven review
A focused, open-source option for dependency SBOMs in Maven builds.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
For Java teams working in Apache Maven, CycloneDX Maven generates CycloneDX Software Bills of Materials from project dependencies. It is an open-source plugin maintained by the CycloneDX project under the OWASP Foundation, rather than a hosted subscription service. Its scope is specific: Maven projects and their dependencies, not container images or standalone binaries. That focus makes it a natural fit when dependency inventory is the goal and Maven is already the build environment; teams seeking a broader input scope should consider another tool.
The plugin can produce aggregate BOMs covering direct and transitive dependencies, with an aggregate goal for multi-module Maven reactor projects. Teams can exclude selected reactor modules from an aggregate BOM, and configure the plugin as part of the Maven build lifecycle. Output is available in CycloneDX JSON or XML, and vulnerability disclosure information can be attached. These options make it suited to generating dependency inventories within an existing Maven build, rather than requiring a separate hosted workflow.
CycloneDX Maven is open source and has a free plan, with self-hosted deployment. Its integration is Apache Maven; the published scope is CycloneDX output rather than SPDX, and the plugin is not described as accepting container or binary inputs. Choose it for Maven dependency SBOMs, including multi-module builds, when that format and input scope are sufficient. It is a less suitable match if you need a hosted product, broader artifact inputs, or SPDX output.
CycloneDX Maven pros and cons
- Where it wins
- Includes direct and transitive dependencies in aggregate BOMs
- Outputs CycloneDX SBOMs in JSON or XML
- Supports multi-module builds and Maven lifecycle configuration
- Where it doesn't
- Focused on Apache Maven projects
- Does not output SPDX
- Does not accept container images or standalone binaries as input
CycloneDX Maven fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update