Create a CycloneDX VEX document to communicate that a specific CVE does not affect your product and associate it with an SBOM

Steps

1. Understand the VEX analysis states: not_affected, affected, fixed, and under_investigation; choose not_affected when the CVE is present in a dependency but your product does not exercise the vulnerable code path.
2. Author a CycloneDX VEX JSON document with a vulnerabilities array; for each entry set the id to the CVE identifier, the analysis.state to not_affected, and populate analysis.justification with one of the defined CycloneDX justification codes (e.g., code_not_reachable).
3. Reference the SBOM BOM serial number and version in the VEX document's metadata to associate the VEX with a specific SBOM generation.
4. Publish the VEX document alongside the SBOM (e.g., as a cosign attestation or as a file in a release artifact bundle) so downstream consumers can apply it when scanning.
5. Pass the VEX document to vulnerability scanners that support VEX filtering (e.g., Trivy with --vex) to suppress not_affected findings from scan reports.