{"url":"https://pypi.sbomify.com/package/componentize-py/0.25.1","markdown_url":"https://pypi.sbomify.com/package/componentize-py/0.25.1.md","name":"componentize-py","version":"0.25.1","purl":"pkg:pypi/componentize-py@0.25.1","summary":"Tool to package Python applications as WebAssembly components","author":null,"project_urls":{"repository":"https://github.com/bytecodealliance/componentize-py"},"requires_python":null,"license":null,"classifiers":[],"wheels":[{"filename":"componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/a1/fc/ea8ac30a3de452626e32c051a38f548e9f7863cd10c35705396e257ac029/componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"70eb2f5d-f010-5148-8d99-bbc09d0a2c70","path":"componentize_py-0.25.1.dist-info/sboms/componentize-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/70eb2f5d-f010-5148-8d99-bbc09d0a2c70/download","vulnerability_count":60,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/4b/9c/f444240899a9b43c60b808d0ece5dff8f3dc6831aa119a1d8eb28d952bad/componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"ad0fb04d-cb46-5cf6-811e-21441e2fb854","path":"componentize_py-0.25.1.dist-info/sboms/componentize-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/ad0fb04d-cb46-5cf6-811e-21441e2fb854/download","vulnerability_count":60,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","url":"https://files.pythonhosted.org/packages/56/66/24a9671f1d9c608e53a8d5ae4873d1fc480f0603488a2f46132e70cc6839/componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","sboms":[{"artifact_uuid":"63199de5-0f11-58f4-9be3-a4a6dc4206c2","path":"componentize_py-0.25.1.dist-info/sboms/componentize-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/63199de5-0f11-58f4-9be3-a4a6dc4206c2/download","vulnerability_count":60,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","url":"https://files.pythonhosted.org/packages/ed/c6/ad1431751ff1969a132323f6e2797ec38ccdf9d0a53aabb45d79221092a4/componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","sboms":[{"artifact_uuid":"ddeb3641-3be6-5128-a5c9-413180ee7a8b","path":"componentize_py-0.25.1.dist-info/sboms/componentize-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/ddeb3641-3be6-5128-a5c9-413180ee7a8b/download","vulnerability_count":60,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"componentize_py-0.25.1-cp39-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/4b/60/5b08715534795d84feec8ec8ae50599681ea1199ee7b300ad072fdcd24af/componentize_py-0.25.1-cp39-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"48c32dcb-eac6-5fd9-8c62-b3c606178072","path":"componentize_py-0.25.1.dist-info/sboms/componentize-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/48c32dcb-eac6-5fd9-8c62-b3c606178072/download","vulnerability_count":60,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":5,"has_attestation":false,"vulnerabilities":[{"id":"CVE-2026-115893","aliases":["GHSA-mghf-wjfp-p5xm","RUSTSEC-2026-0379"],"summary":"Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","severity":"critical","score":9.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.7"],"url":"https://insights.sbomify.com/CVE-2026-115893/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115384","aliases":["GHSA-32h6-97mm-8q3c","RUSTSEC-2026-0327"],"summary":"Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow","severity":"critical","score":9.3,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.4"],"url":"https://insights.sbomify.com/CVE-2026-115384/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115392","aliases":["GHSA-vqjp-4c8c-hfgg","RUSTSEC-2026-0269"],"summary":"Filesystem sandbox escape when paths or symlinks contain trailing slashes","severity":"high","score":8.8,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["46.0.3"],"url":"https://insights.sbomify.com/CVE-2026-115392/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-118688","aliases":["GHSA-m9f7-9w4p-gv38","RUSTSEC-2026-0352"],"summary":"Filesystem sandbox escape when renaming symlinks with trailing slashes","severity":"high","score":8.8,"package":"wasmtime-wasi","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-118688/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.28.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.28.3","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-25800","aliases":["GHSA-4w2j-m93h-cj5j","RUSTSEC-2026-0185"],"summary":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.15"],"url":"https://insights.sbomify.com/CVE-2026-25800/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0340","aliases":["GHSA-3g6h-r5qx-f6hq"],"summary":"Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0340","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115391","aliases":["GHSA-x84v-gj2h-g759","RUSTSEC-2026-0268"],"summary":"Guest controlled-size host heap allocation through WASIp3 streams","severity":"medium","score":6.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["46.0.3"],"url":"https://insights.sbomify.com/CVE-2026-115391/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.28.3","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.28.3","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119134","aliases":["GHSA-q554-3cjc-rx7p","RUSTSEC-2026-0363"],"summary":"Component-model handle tables are capped only per instance and charged to no limit","severity":"medium","score":6.2,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119134/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115385","aliases":["GHSA-mr2v-56j5-cmfc","RUSTSEC-2026-0324"],"summary":"Guest can panic host through filesystem timestamp before the epoch on wasip3","severity":"medium","score":6.2,"package":"wasmtime-wasi","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@46.0.1","fixed":["48.0.4"],"url":"https://insights.sbomify.com/CVE-2026-115385/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115387","aliases":["GHSA-j2g9-4prp-pf6h","RUSTSEC-2026-0314"],"summary":"Guest can panic host through filesystem datetime overflow","severity":"medium","score":6.2,"package":"wasmtime-wasi","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@46.0.1","fixed":["48.0.3"],"url":"https://insights.sbomify.com/CVE-2026-115387/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119135","aliases":["GHSA-63h4-6cx9-pjfj","RUSTSEC-2026-0355"],"summary":"Panic viewing component model stream or future as the wrong type","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119135/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119136","aliases":["GHSA-vcg5-q8m5-8379","RUSTSEC-2026-0362"],"summary":"Wasmtime may not properly enforce async-entrypoint requirement","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119136/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119138","aliases":["GHSA-hmwq-g22x-qjw5","RUSTSEC-2026-0361"],"summary":"Panic when pending calls are run after a trap","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119138/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119139","aliases":["GHSA-m6w2-jwq2-cv2c","RUSTSEC-2026-0353"],"summary":"Panic when invoking an async-lifted function via `call`","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119139/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119140","aliases":["GHSA-5hhx-4wrr-3j9g","RUSTSEC-2026-0358"],"summary":"Yielding in a component start function can lead to a host panic","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119140/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119142","aliases":["GHSA-3r89-v5mq-j5xf","RUSTSEC-2026-0354"],"summary":"Host panic when component `call_async` is cancelled under some conditions","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119142/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119143","aliases":["GHSA-93g3-36p8-x2gc","RUSTSEC-2026-0357"],"summary":"Out-of-bounds zero-length stream writes can panic","severity":"medium","score":5.9,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119143/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115381","aliases":["GHSA-gqmc-89g8-p25r","RUSTSEC-2026-0322"],"summary":"Excessive allocated memory on the host when guests don't have stdio","severity":"medium","score":5.9,"package":"wasmtime-wasi","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@46.0.1","fixed":["48.0.4"],"url":"https://insights.sbomify.com/CVE-2026-115381/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115892","aliases":["GHSA-9pvw-hwfg-92h5","RUSTSEC-2026-0378"],"summary":"Panic lowering a host-created component model stream into a guest that expects a different payload type","severity":"medium","score":5.7,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.7"],"url":"https://insights.sbomify.com/CVE-2026-115892/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-123613","aliases":["GHSA-2mjx-qc3c-rqvc","RUSTSEC-2026-0285"],"summary":"TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","severity":"medium","score":5.3,"package":"rustls","version":"0.23.40","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.40","fixed":["0.23.45"],"url":"https://insights.sbomify.com/CVE-2026-123613/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119137","aliases":["GHSA-wjc8-633q-pwxr","RUSTSEC-2026-0359"],"summary":"Stack overflow dropping a long chain of recursive types","severity":"medium","score":5.3,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119137/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119141","aliases":["GHSA-7v24-42x9-pxf7","RUSTSEC-2026-0356"],"summary":"Panic on erroneous call-to-host from guest realloc call","severity":"medium","score":5.3,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119141/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.23.40","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.40","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115380","aliases":["GHSA-j366-h8gg-77pm","RUSTSEC-2026-0321"],"summary":"WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption","severity":"medium","score":4.0,"package":"wasmtime-wasi","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@46.0.1","fixed":["48.0.4"],"url":"https://insights.sbomify.com/CVE-2026-115380/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115393","aliases":["GHSA-hgjw-h833-99q9","RUSTSEC-2026-0222"],"summary":"Stores can mix up type indices between engines","severity":"low","score":3.8,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["46.0.2"],"url":"https://insights.sbomify.com/CVE-2026-115393/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Brotli certificate decompression can allocate up to 1 GiB before authentication","severity":"low","score":3.7,"package":"rustls","version":"0.23.40","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.40","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.23.40","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.40","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115386","aliases":["GHSA-96f6-r43r-8c24","RUSTSEC-2026-0323"],"summary":"fd_readdir copies uninitialized struct padding into guest memory","severity":"low","score":2.1,"package":"wasmtime-wasi","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@46.0.1","fixed":["48.0.4"],"url":"https://insights.sbomify.com/CVE-2026-115386/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-104855","aliases":["GHSA-2hw9-mc66-jc2q","RUSTSEC-2026-0223"],"summary":"Preemption and traps during bulk operations enable breaking internal VM state","severity":"low","score":2.0,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["46.0.2"],"url":"https://insights.sbomify.com/CVE-2026-104855/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-115389","aliases":["GHSA-jqpg-j7w6-42pr","RUSTSEC-2026-0316"],"summary":"Dynamic record lifting can allocate beyond the hostcall fuel limit","severity":"low","score":1.0,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.3"],"url":"https://insights.sbomify.com/CVE-2026-115389/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0190","aliases":[],"summary":"Unsoundness in `Error::downcast_mut()`","severity":"unknown","score":null,"package":"anyhow","version":"1.0.102","ecosystem":"crates.io","purl":"pkg:cargo/anyhow@1.0.102","fixed":["1.0.103"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0190","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0141","aliases":[],"summary":"Bincode is unmaintained","severity":"unknown","score":null,"package":"bincode","version":"1.3.3","ecosystem":"crates.io","purl":"pkg:cargo/bincode@1.3.3","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0141","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0247","aliases":[],"summary":"bitmaps is unmaintained","severity":"unknown","score":null,"package":"bitmaps","version":"2.1.0","ecosystem":"crates.io","purl":"pkg:cargo/bitmaps@2.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0247","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0250","aliases":[],"summary":"im-rc is unmaintained","severity":"unknown","score":null,"package":"im-rc","version":"15.1.0","ecosystem":"crates.io","purl":"pkg:cargo/im-rc@15.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0250","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.103.13","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.13","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0251","aliases":[],"summary":"sized-chunks is unmaintained","severity":"unknown","score":null,"package":"sized-chunks","version":"0.6.5","ecosystem":"crates.io","purl":"pkg:cargo/sized-chunks@0.6.5","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0251","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0255","aliases":[],"summary":"Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)","severity":"unknown","score":null,"package":"sized-chunks","version":"0.6.5","ecosystem":"crates.io","purl":"pkg:cargo/sized-chunks@0.6.5","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0255","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0386","aliases":[],"summary":"`AsyncFd::new` and related constructors violate I/O safety","severity":"unknown","score":null,"package":"tokio","version":"1.52.3","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.52.3","fixed":["1.53.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0386","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0424","aliases":["GHSA-6fr9-xmw9-5352"],"summary":"Unchecked memory usage in transferring borrowed resources between components","severity":"unknown","score":null,"package":"wasmtime","version":"46.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@46.0.1","fixed":["48.0.8"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0424","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates","severity":"unknown","score":null,"package":"webpki-roots","version":"1.0.7","ecosystem":"crates.io","purl":"pkg:cargo/webpki-roots@1.0.7","fixed":["1.0.10"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0391","aliases":[],"summary":"Data from an abandoned stream leaks into the next stream on a reused context","severity":"unknown","score":null,"package":"zstd","version":"0.13.3","ecosystem":"crates.io","purl":"pkg:cargo/zstd@0.13.3","fixed":["0.13.4"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0391","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0395","aliases":[],"summary":"Use-after-free with `CParameter::StableInBuffer`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0395","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0396","aliases":[],"summary":"`Seekable` reads a NULL or out-of-bounds seek table","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0396","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0397","aliases":[],"summary":"`OutBuffer::around_pos` exposes uninitialized memory","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0397","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0398","aliases":[],"summary":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0398","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0399","aliases":[],"summary":"Use-after-free through `init_using_cdict` and `init_using_ddict`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0400","aliases":[],"summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0401","aliases":[],"summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0401","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0402","aliases":[],"summary":"Heap buffer overflow in `CCtx::try_clone` on a multithreaded context","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0402","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0403","aliases":[],"summary":"Uninitialized memory exposed when streaming decompression of a legacy frame fails","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0403","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0404","aliases":[],"summary":"Double free in `DCtx::try_clone`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0404","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0405","aliases":[],"summary":"Out-of-bounds read with an out-of-range `InBuffer::pos`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0405","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0406","aliases":[],"summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0410","aliases":[],"summary":"WebAssembly allocator shim corrupts memory on allocation failure","severity":"unknown","score":null,"package":"zstd-sys","version":"2.0.16+zstd.1.5.7","ecosystem":"crates.io","purl":"pkg:cargo/zstd-sys@2.0.16%2Bzstd.1.5.7","fixed":["2.1.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0410","wheels":["componentize_py-0.25.1-cp39-abi3-macosx_10_12_x86_64.whl","componentize_py-0.25.1-cp39-abi3-macosx_11_0_arm64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_aarch64.whl","componentize_py-0.25.1-cp39-abi3-manylinux_2_28_x86_64.whl","componentize_py-0.25.1-cp39-abi3-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":5,"total_sboms":5,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"critical":2,"high":5,"medium":19,"low":6,"unknown":28}}}