# SBOM for bomiot-asgi 0.6.34 The Python package bomiot-asgi 0.6.34 ships 30 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/bomiot-asgi@0.6.34` - PyPI: https://pypi.org/project/bomiot-asgi/0.6.34/ - Requires Python: \>=3.9 ## SBOMs ### bomiot\_asgi-0.6.34-cp310-cp310-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/538cc1f5-70f0-5179-85fa-5b10d35b8f3c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/466657e2-df01-584f-a610-e77fe975d9a0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp310-cp310-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/ce6f3b6e-d1f5-50ad-aa09-9e65c925c34b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/8667aceb-2458-5fc1-a0b7-47982f28c013/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/8aa15973-9be3-55d3-853f-204e6dc57021/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp310-cp310-win\_amd64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/c83fbf04-81d5-550d-ac35-2a5c44a19bef/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp311-cp311-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/576bd2f1-5f0f-5222-9fea-4957e2346946/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/eba23226-c1c6-5537-9c0e-f80ffb492b1d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp311-cp311-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/faffadc8-c23f-504d-a469-6ac5870a44d4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/b49a4698-a703-529d-8ac0-0adae142e0aa/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/63e0b5b9-fb3b-5181-b585-53fc3fe29aa4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp311-cp311-win\_amd64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/d075aa12-55a7-57bd-88e6-aed9332680c6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp312-cp312-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/81fef277-71bc-510e-a135-b0fc9518896e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/38cc2f3a-ae38-5e5b-93d3-c3e839f5562f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp312-cp312-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/f3136196-2110-5ebb-8072-96d3b45e0d3d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/bd57a4d2-c8e4-57d9-9d6b-00a89436d66d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/93001a65-6370-50ce-8c42-722e74fe0582/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp312-cp312-win\_amd64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/33247fc6-e293-5148-a7c4-eecafa36f92b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp313-cp313-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/abfec418-43f9-5c38-99e9-10567726e8da/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/0ae460e1-7c0f-5892-a992-abc71154a8a7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp313-cp313-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/6400d221-0d9a-5638-baa5-b7405735f44f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/e044f173-98ec-55f6-9278-ab8bc9a250c8/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/67a2e451-b840-5310-88d8-c31cbf863651/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp313-cp313-win\_amd64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/1a614281-961e-518c-8885-83a8ed841bf6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp39-cp39-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/4a526db3-b50f-53df-baac-4f6b1b373c45/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ### bomiot\_asgi-0.6.34-cp39-cp39-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/19d1e310-0d16-5c96-8bdb-40afc9d39c0c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp39-cp39-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/2242e04e-59d2-56ef-b9bd-800c96ce5482/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp39-cp39-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/430aa287-f90d-504e-95e0-177a80d37535/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/4826d725-4da1-5080-93ba-595561ef489d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### bomiot\_asgi-0.6.34-cp39-cp39-win\_amd64.whl - [bomiot\_asgi-0.6.34.dist-info/sboms/bomiot\_asgi.cyclonedx.json](https://pypi.sbomify.com/artifact/b8223014-fe3c-5c20-8781-c08a6ccb6dfb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.73 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs | | [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.19.2 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-openssl: rustMdCtxRef::digest\_final() writes past caller buffer with no length check | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.73 (crates.io) | 0.10.78 | Out-of-bounds write in \`aes::unwrap\_key\` | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.19.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.73 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.73 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers | | [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.19.2 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.73 (crates.io) | 0.10.78 | rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | | [RUSTSEC-2026-0258](https://osv.dev/vulnerability/RUSTSEC-2026-0258) | unknown | h2 0.3.27 (crates.io) | 0.4.16 | h2 unbounded empty DATA frames | | [RUSTSEC-2025-0134](https://osv.dev/vulnerability/RUSTSEC-2025-0134) | unknown | rustls-pemfile 1.0.4 (crates.io) | none listed | rustls-pemfile is unmaintained | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/bomiot-asgi@0.6.34 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/bomiot-asgi/0.6.34.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/bomiot-asgi/0.6.34