# SBOM for chik-rs 0.53.0 The Python package chik-rs 0.53.0 ships 28 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/chik-rs@0.53.0` - PyPI: https://pypi.org/project/chik-rs/0.53.0/ - Homepage: ## SBOMs ### chik\_rs-0.53.0-cp311-cp311-macosx\_13\_0\_arm64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/3154263b-9ffc-52cd-b4fd-e61daac40eff/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp311-cp311-macosx\_13\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/e4c7b90e-66ff-5c54-b838-dd211da7dcfc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp311-cp311-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/78545d34-8ee9-5efa-9d9d-3590261560da/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/420a79c5-4fe7-51ec-9b03-315708af2dbc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp311-cp311-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6bd309b2-f369-555f-b496-dd5e75325c1f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/bd9ef3b6-7b35-5180-9519-5d474a946f26/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp311-cp311-win\_amd64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/5ff6db23-4608-5b86-aa7c-3a4ecf03bc68/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 22 known vulnerabilities ### chik\_rs-0.53.0-cp312-cp312-macosx\_13\_0\_arm64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/a7f30787-b692-595a-9a8d-33e0d8bafda7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp312-cp312-macosx\_13\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/e3c44701-a36b-5ab4-9a21-266a064355ec/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp312-cp312-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/beabeaad-dd72-5bc8-90ad-51a142a43c53/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/a863192f-997c-5f7d-9949-362f4fa0bd29/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp312-cp312-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/c0b8ffc3-31f1-5864-8544-e65270332cbc/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/ae301a14-9fe3-54f2-af1e-86677f7ccfdf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp312-cp312-win\_amd64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/2efd5de0-aa4f-5e53-8f68-fec142ca497c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 22 known vulnerabilities ### chik\_rs-0.53.0-cp313-cp313-macosx\_13\_0\_arm64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/30458c95-c063-5744-9a12-e0d321540701/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp313-cp313-macosx\_13\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/73d91194-7d68-5eec-9a0c-4f9ae020e56d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp313-cp313-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/60e4aef5-b652-594d-bd8d-4030cf4b39f0/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/9b7e8814-bf03-5714-80a4-1c3a89aced7b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp313-cp313-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/01b51893-f4d2-54c0-97bc-045ac24a200e/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/4deb9e44-83f3-551c-890a-a134ec55f8f9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp313-cp313-win\_amd64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/279b1b2a-ae57-5ed9-a4ca-dfb28136a9f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 22 known vulnerabilities ### chik\_rs-0.53.0-cp314-cp314-macosx\_13\_0\_arm64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/867798a2-7b87-5d5d-bf24-07f0a9526ac6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp314-cp314-macosx\_13\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/56456e70-08fc-5c60-9431-426e8f4020af/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp314-cp314-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/967e9caa-68a2-5f39-9901-f989dd004ee3/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/6a2a46fd-7a76-5176-860d-f9e06ffdf294/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp314-cp314-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/62f8bedf-c948-5571-8ae5-5c1c721623db/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/6c306be9-541e-52ec-93e8-1a9a87e8e8b2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 30 known vulnerabilities ### chik\_rs-0.53.0-cp314-cp314-win\_amd64.whl PEP 740 attestation verified (GitHub, Chik-Network/chik\_rs, workflow build-wheels.yml). - [chik\_rs-0.53.0.dist-info/sboms/chik\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/8dda5c99-1856-5500-9950-3a8255b50450/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 22 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.72 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-openssl: rustMdCtxRef::digest\_final() writes past caller buffer with no length check | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.72 (crates.io) | 0.10.78 | Out-of-bounds write in \`aes::unwrap\_key\` | | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/) | medium (5.9) | rsa 0.10.0-rc.18 (crates.io) | 0.10.0 | Marvin Attack: potential key recovery through timing sidechannels | | [CVE-2026-50185](https://insights.sbomify.com/CVE-2026-50185/) | medium (5.5) | cmov 0.5.3 (crates.io) | 0.5.4 | Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.72 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.72 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.72 (crates.io) | 0.10.78 | rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | | [RUSTSEC-2026-0012](https://osv.dev/vulnerability/RUSTSEC-2026-0012) | low (0.5) | keccak 0.1.5 (crates.io) | 0.1.6 | Unsoundness in opt-in ARMv8 assembly backend for \`keccak\` | | [RUSTSEC-2025-0056](https://osv.dev/vulnerability/RUSTSEC-2025-0056) | unknown | adler 1.0.2 (crates.io) | none listed | adler crate is unmaintained, use adler2 instead | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.100 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.9.2 (crates.io) | 0.9.3 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.45.0 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | | [RUSTSEC-2026-0391](https://osv.dev/vulnerability/RUSTSEC-2026-0391) | unknown | zstd 0.13.3 (crates.io) | 0.13.4 | Data from an abandoned stream leaks into the next stream on a reused context | | [RUSTSEC-2026-0395](https://osv.dev/vulnerability/RUSTSEC-2026-0395) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Use-after-free with \`CParameter::StableInBuffer\` | | [RUSTSEC-2026-0397](https://osv.dev/vulnerability/RUSTSEC-2026-0397) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | \`OutBuffer::around\_pos\` exposes uninitialized memory | | [RUSTSEC-2026-0399](https://osv.dev/vulnerability/RUSTSEC-2026-0399) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Use-after-free through \`init\_using\_cdict\` and \`init\_using\_ddict\` | | [RUSTSEC-2026-0400](https://osv.dev/vulnerability/RUSTSEC-2026-0400) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Use-after-free of a dictionary after a one-shot call on a context with an open stream | | [RUSTSEC-2026-0401](https://osv.dev/vulnerability/RUSTSEC-2026-0401) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Out-of-bounds read in \`train\_from\_buffer\` when sample sizes overflow | | [RUSTSEC-2026-0402](https://osv.dev/vulnerability/RUSTSEC-2026-0402) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Heap buffer overflow in \`CCtx::try\_clone\` on a multithreaded context | | [RUSTSEC-2026-0403](https://osv.dev/vulnerability/RUSTSEC-2026-0403) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Uninitialized memory exposed when streaming decompression of a legacy frame fails | | [RUSTSEC-2026-0404](https://osv.dev/vulnerability/RUSTSEC-2026-0404) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Double free in \`DCtx::try\_clone\` | | [RUSTSEC-2026-0406](https://osv.dev/vulnerability/RUSTSEC-2026-0406) | unknown | zstd-safe 7.2.0 (crates.io) | 7.4.0 | Use-after-free when changing a multithreaded context with an unfinished frame | | [RUSTSEC-2026-0410](https://osv.dev/vulnerability/RUSTSEC-2026-0410) | unknown | zstd-sys 2.0.12+zstd.1.5.6 (crates.io) | 2.1.2 | WebAssembly allocator shim corrupts memory on allocation failure | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/chik-rs@0.53.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/chik-rs/0.53.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/chik-rs/0.53.0