{"url":"https://pypi.sbomify.com/package/cello-framework/1.4.1","markdown_url":"https://pypi.sbomify.com/package/cello-framework/1.4.1.md","name":"cello-framework","version":"1.4.1","purl":"pkg:pypi/cello-framework@1.4.1","summary":"Ultra-fast Rust-powered Python async web framework","author":"Jagadeesh Katla","project_urls":{"Documentation":"https://cello.lineupcode.com/","Homepage":"https://github.com/jagadeesh32/cello","Repository":"https://github.com/jagadeesh32/cello"},"requires_python":">=3.12","license":"MIT","classifiers":["Development Status :: 5 - Production/Stable","Framework :: AsyncIO","Intended Audience :: Developers","License :: OSI Approved :: MIT License","Operating System :: MacOS","Operating System :: Microsoft :: Windows","Operating System :: OS Independent","Operating System :: POSIX :: Linux","Programming Language :: Python :: 3","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.14","Programming Language :: Rust","Topic :: Internet :: WWW/HTTP :: HTTP Servers"],"wheels":[{"filename":"cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/c7/9d/07bdf08a0dc00ba9172ed5b0111b9aba745a6731dec797b4c01246a8c236/cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"658f4050-c9cd-5af2-a50b-142dbc90abd1","path":"cello_framework-1.4.1.dist-info/sboms/cello-framework.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/658f4050-c9cd-5af2-a50b-142dbc90abd1/download","vulnerability_count":36,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"jagadeesh32/cello","workflow":"publish.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.10":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/jagadeesh32/cello","1.3.6.1.4.1.57264.1.13":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.14":"refs/heads/release","1.3.6.1.4.1.57264.1.15":"1116207522","1.3.6.1.4.1.57264.1.16":"https://github.com/jagadeesh32","1.3.6.1.4.1.57264.1.17":"29976675","1.3.6.1.4.1.57264.1.18":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.19":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/jagadeesh32/cello/actions/runs/39572558183/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","url":"https://files.pythonhosted.org/packages/37/d7/90ca42e0fc341fa7a7277355915ab8d2edee6ff7158bb02f4c21a2d9f8eb/cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","sboms":[{"artifact_uuid":"8574e3da-7588-5aa5-839a-e6495581cf13","path":"cello_framework-1.4.1.dist-info/sboms/cello-framework.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/8574e3da-7588-5aa5-839a-e6495581cf13/download","vulnerability_count":36,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"jagadeesh32/cello","workflow":"publish.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.10":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/jagadeesh32/cello","1.3.6.1.4.1.57264.1.13":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.14":"refs/heads/release","1.3.6.1.4.1.57264.1.15":"1116207522","1.3.6.1.4.1.57264.1.16":"https://github.com/jagadeesh32","1.3.6.1.4.1.57264.1.17":"29976675","1.3.6.1.4.1.57264.1.18":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.19":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/jagadeesh32/cello/actions/runs/39572558183/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","url":"https://files.pythonhosted.org/packages/0d/07/a5e1b783fc2da01bb4207e98f1b765be98bb1f2e91892f6fe7b09115178b/cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","sboms":[{"artifact_uuid":"fd0cea0e-b190-587f-be78-e16ee7b3c2ee","path":"cello_framework-1.4.1.dist-info/sboms/cello-framework.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/fd0cea0e-b190-587f-be78-e16ee7b3c2ee/download","vulnerability_count":36,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"jagadeesh32/cello","workflow":"publish.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.10":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/jagadeesh32/cello","1.3.6.1.4.1.57264.1.13":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.14":"refs/heads/release","1.3.6.1.4.1.57264.1.15":"1116207522","1.3.6.1.4.1.57264.1.16":"https://github.com/jagadeesh32","1.3.6.1.4.1.57264.1.17":"29976675","1.3.6.1.4.1.57264.1.18":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.19":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/jagadeesh32/cello/actions/runs/39572558183/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"cello_framework-1.4.1-cp312-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/42/9b/2870c655b6b175ccd2e79a1b28b6705d59357a4476177900b2d04f244bf5/cello_framework-1.4.1-cp312-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"74111df4-23e5-50b4-9aa6-60b5a99f5cb1","path":"cello_framework-1.4.1.dist-info/sboms/cello-framework.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/74111df4-23e5-50b4-9aa6-60b5a99f5cb1/download","vulnerability_count":36,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"jagadeesh32/cello","workflow":"publish.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.10":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/jagadeesh32/cello","1.3.6.1.4.1.57264.1.13":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.14":"refs/heads/release","1.3.6.1.4.1.57264.1.15":"1116207522","1.3.6.1.4.1.57264.1.16":"https://github.com/jagadeesh32","1.3.6.1.4.1.57264.1.17":"29976675","1.3.6.1.4.1.57264.1.18":"https://github.com/jagadeesh32/cello/.github/workflows/publish.yml@refs/heads/release","1.3.6.1.4.1.57264.1.19":"e9dac907dc0f5effcfa901078f313f0a8e30fa08","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/jagadeesh32/cello/actions/runs/39572558183/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}}],"formats":["CycloneDX"],"sbom_count":4,"has_attestation":true,"vulnerabilities":[{"id":"GHSA-36hh-v3qg-5jq4","aliases":["RUSTSEC-2026-0176"],"summary":"PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.20.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.20.3","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-31812","aliases":["GHSA-6xvm-j4wr-6v98","RUSTSEC-2026-0037"],"summary":"Denial of service in Quinn endpoints","severity":"high","score":8.7,"package":"quinn-proto","version":"0.10.6","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.10.6","fixed":["0.11.14"],"url":"https://insights.sbomify.com/CVE-2026-31812/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0194","aliases":[],"summary":"Quadratic run time when checking a start tag for duplicate attribute names","severity":"high","score":7.5,"package":"quick-xml","version":"0.31.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.31.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0194","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0195","aliases":[],"summary":"Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service","severity":"high","score":7.5,"package":"quick-xml","version":"0.31.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.31.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0195","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-25800","aliases":["GHSA-4w2j-m93h-cj5j","RUSTSEC-2026-0185"],"summary":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","severity":"high","score":7.5,"package":"quinn-proto","version":"0.10.6","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.10.6","fixed":["0.11.15"],"url":"https://insights.sbomify.com/CVE-2026-25800/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2025-53605","aliases":["GHSA-2gh3-rmm4-6rq5","RUSTSEC-2024-0437"],"summary":"Crash due to uncontrolled recursion in protobuf crate","severity":"medium","score":6.6,"package":"protobuf","version":"2.28.0","ecosystem":"crates.io","purl":"pkg:cargo/protobuf@2.28.0","fixed":["3.7.2"],"url":"https://insights.sbomify.com/CVE-2025-53605/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2025-4432","aliases":["GHSA-4p46-pwfr-66x6","GHSA-c86p-w88r-qvqr","GO-2025-3678","RUSTSEC-2025-0009"],"summary":"Some AES functions may panic when overflow checking is enabled.","severity":"medium","score":6.6,"package":"ring","version":"0.16.20","ecosystem":"crates.io","purl":"pkg:cargo/ring@0.16.20","fixed":["0.17.12"],"url":"https://insights.sbomify.com/CVE-2025-4432/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.20.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.20.3","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-115567","aliases":["GHSA-5wjr-9356-4wc8","RUSTSEC-2026-0384"],"summary":"Race condition in `tokio::time::Interval` on Tokio v1.54.0","severity":"medium","score":5.8,"package":"tokio","version":"1.54.0","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.54.0","fixed":["1.54.1"],"url":"https://insights.sbomify.com/CVE-2026-115567/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-25537","aliases":["GHSA-h395-gr6q-cpjc"],"summary":"jsonwebtoken has Type Confusion that leads to potential authorization bypass","severity":"medium","score":5.5,"package":"jsonwebtoken","version":"9.3.1","ecosystem":"crates.io","purl":"pkg:cargo/jsonwebtoken@9.3.1","fixed":["10.3.0"],"url":"https://insights.sbomify.com/CVE-2026-25537/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-48504","aliases":["GHSA-w9wp-h8wv-79jx"],"summary":"opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation","severity":"medium","score":5.3,"package":"opentelemetry_sdk","version":"0.21.2","ecosystem":"crates.io","purl":"pkg:cargo/opentelemetry_sdk@0.21.2","fixed":["0.32.1"],"url":"https://insights.sbomify.com/CVE-2026-48504/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93602","aliases":["GHSA-pwjx-qhcg-rvj4","RUSTSEC-2026-0049"],"summary":"CRLs not considered authoritative by Distribution Point due to faulty matching logic","severity":"medium","score":4.4,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.10"],"url":"https://insights.sbomify.com/CVE-2026-93602/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.22.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.22.4","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","severity":"low","score":3.7,"package":"rustls","version":"0.22.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.22.4","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.22.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.22.4","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0020","aliases":["GHSA-pph8-gcv7-4qj5"],"summary":"Risk of buffer overflow in `PyString::from_object`","severity":"low","score":2.9,"package":"pyo3","version":"0.20.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.20.3","fixed":["0.24.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0020","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0385","aliases":[],"summary":"Non-constant-time mask generation and `u128` comparisons","severity":"unknown","score":null,"package":"ctutils","version":"0.4.3","ecosystem":"crates.io","purl":"pkg:cargo/ctutils@0.4.3","fixed":["0.4.4"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0385","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.3.27","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.3.27","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.10.6","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.10.6","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.10.6","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.10.6","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.10.6","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.10.6","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0010","aliases":[],"summary":"Versions of *ring* prior to 0.17 are unmaintained.","severity":"unknown","score":null,"package":"ring","version":"0.16.20","ecosystem":"crates.io","purl":"pkg:cargo/ring@0.16.20","fixed":["0.17.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0010","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"1.0.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@1.0.4","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"2.2.0","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@2.2.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates","severity":"unknown","score":null,"package":"webpki-roots","version":"0.25.4","ecosystem":"crates.io","purl":"pkg:cargo/webpki-roots@0.25.4","fixed":["0.26.11"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["cello_framework-1.4.1-cp312-abi3-macosx_11_0_arm64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","cello_framework-1.4.1-cp312-abi3-manylinux_2_28_aarch64.whl","cello_framework-1.4.1-cp312-abi3-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":4,"total_sboms":4,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":7,"medium":9,"low":9,"unknown":11}}}