What Is a PURL? Understanding Package URLs and Why They Are Critical for SBOM Accuracy

The PURL Format

A Package URL is a structured string that uniquely identifies a software package across all ecosystems using a consistent syntax. The format is: pkg:type/namespace/name@version?qualifiers#subpath. The required fields are the scheme (pkg:), the package type (ecosystem), and the package name. The version, qualifiers, and subpath are optional but important for precision.

Examples by ecosystem: npm package pkg:npm/%40angular/core@16.0.0; PyPI package pkg:pypi/requests@2.31.0; Maven artifact pkg:maven/org.springframework/spring-core@6.1.0; Go module pkg:golang/github.com/gorilla/mux@v1.8.0; Cargo crate pkg:cargo/serde@1.0.193; Docker image pkg:docker/nginx@1.25.3.

Why PURLs Matter for Vulnerability Matching

Vulnerability databases index vulnerabilities by package identifier. NVD uses CPE (Common Platform Enumeration). OSV uses PURLs. GHSA uses PURLs. Without a standardized identifier in your SBOM, matching a component to a CVE requires fuzzy name matching — which produces both false positives (flagging components that are not actually vulnerable) and false negatives (missing vulnerabilities because the component name in the SBOM does not exactly match the database entry).

PURLs solve this problem with precision. A PURL uniquely identifies a specific version of a specific package in a specific ecosystem. Vulnerability databases that index by PURL can return exact matches — eliminating ambiguity and improving scanner accuracy significantly.

PURL Accuracy Is an SBOM Quality Issue

One of the most common SBOM quality problems is incorrect or missing PURLs. Common failures include: generating PURLs from package metadata that is incomplete or non-standard; using the wrong package type prefix (confusing npm and yarn packages, for example); missing the namespace for scoped packages (the %40 in @angular/core must be encoded correctly); or omitting PURLs entirely for binary-analyzed components whose package origin is inferred rather than explicit. These errors directly reduce the effectiveness of automated vulnerability scanning against the SBOM.

CPE vs PURL: When to Use Each

CPE (Common Platform Enumeration) is the NIST-defined identifier used in NVD. PURLs are newer and more package-manager-native. Best practice for modern SBOMs is to include both when possible — PURL for OSV/GHSA matching, CPE for NVD matching. SCA tools that generate both identifiers provide more complete vulnerability matching across all major databases.