# SBOM for demoparser2 0.42.1 The Python package demoparser2 0.42.1 ships 30 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/demoparser2@0.42.1` - PyPI: https://pypi.org/project/demoparser2/0.42.1/ - Requires Python: \>=3.8 ## SBOMs ### demoparser2-0.42.1-cp310-cp310-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/f9d021f4-a206-5d92-ad8e-fb22e89fc3f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp310-cp310-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/7061c044-fcfb-5ff2-8f55-20c0879c614f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp310-cp310-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/0e007fce-e4db-54fe-9b8c-cd6a4d38fe28/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp310-cp310-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/bcd76ad3-35c3-50b3-9fe6-98856bbc2912/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp311-cp311-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/6263e42c-0826-550f-bfcc-0cdfd8c489b5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp311-cp311-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/55ebdd8d-88ab-57aa-ba4f-0859b10672bc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp311-cp311-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/3c635037-5afa-5adf-a29b-9c389ff85ab8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp311-cp311-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/02c35f32-0eb6-5506-b5c1-96306b48d0ed/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp312-cp312-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/2d5e10ae-7cad-5027-b1ba-87b4a813ceed/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp312-cp312-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/9e1c01be-bba7-5cb0-a1d9-54a3cadc3ff0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp312-cp312-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/3e9fdd34-b7f5-5b6f-ada5-23880bc494a2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp312-cp312-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/7b8e6c71-071e-5757-8944-0c5c4bc6ad99/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp313-cp313-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/5ad81eb3-659e-5d27-9e9b-af1a1e240db0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp313-cp313-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/3db9207a-32fe-5410-9299-e621dafb0a23/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp313-cp313-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/a916ecb5-3b73-5402-a369-84d8b58186c5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp313-cp313-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/9d2d0c71-429c-56df-8283-1ec7b96470bc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp314-cp314-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/1d55d967-f6de-5de6-962f-41236d1fad57/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp314-cp314-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/1d06fd15-d333-50b2-8a44-2855d2533617/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp314-cp314-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/72bc078e-882b-530f-b946-7d5d396e49e7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp314-cp314-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/4752e0ac-7fee-5786-894a-f4d666546ae5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp37-cp37m-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/5bfa7bcc-be36-52e2-bbfc-b4d751338944/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp37-cp37m-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/b8cd811d-7bd3-5cf1-ba7e-7950dfccf49b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp38-cp38-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/c9210eaf-21fd-5dca-a99a-6a938ad83909/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp38-cp38-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/2e2b71f2-6fd9-5434-832d-cba2476d5ceb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp38-cp38-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/e5c6ec2c-a0d9-5687-86ec-e5c1cb408a47/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp38-cp38-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/49a4493a-d9da-5981-8980-c6137e04057b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp39-cp39-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/9bbeda0c-f85d-5bf8-990f-a616923f705e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp39-cp39-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/5e52eb20-1ccd-5e5a-b374-abc96116cc21/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp39-cp39-win32.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/8b8b125f-8883-5f59-a14d-d01645a03746/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ### demoparser2-0.42.1-cp39-cp39-win\_amd64.whl - [demoparser2-0.42.1.dist-info/sboms/demoparser2.cyclonedx.json](https://pypi.sbomify.com/artifact/1b36f267-9475-5d99-8c91-ed90ad9264d7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 26 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.27.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.27.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/) | medium (5.5) | bytes 1.11.0 (crates.io) | 1.11.1 | Integer overflow in \`BytesMut::reserve\` | | [RUSTSEC-2024-0379](https://osv.dev/vulnerability/RUSTSEC-2024-0379) | low (2.7) | fast-float 0.2.0 (crates.io) | none listed | Multiple soundness issues | | [GHSA-6g2r-675j-hx59](https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59) | low (2.3) | xxhash-rust 0.8.15 (crates.io) | 0.8.16 | xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.100 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2025-0003](https://osv.dev/vulnerability/RUSTSEC-2025-0003) | unknown | fast-float 0.2.0 (crates.io) | none listed | Segmentation fault due to lack of bound check | | [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.7.1 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` | | [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.9 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0249](https://osv.dev/vulnerability/RUSTSEC-2026-0249) | unknown | smartstring 1.0.1 (crates.io) | none listed | smartstring is unmaintained | | [RUSTSEC-2026-0391](https://osv.dev/vulnerability/RUSTSEC-2026-0391) | unknown | zstd 0.13.3 (crates.io) | 0.13.4 | Data from an abandoned stream leaks into the next stream on a reused context | | [RUSTSEC-2026-0395](https://osv.dev/vulnerability/RUSTSEC-2026-0395) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free with \`CParameter::StableInBuffer\` | | [RUSTSEC-2026-0396](https://osv.dev/vulnerability/RUSTSEC-2026-0396) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | \`Seekable\` reads a NULL or out-of-bounds seek table | | [RUSTSEC-2026-0397](https://osv.dev/vulnerability/RUSTSEC-2026-0397) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | \`OutBuffer::around\_pos\` exposes uninitialized memory | | [RUSTSEC-2026-0398](https://osv.dev/vulnerability/RUSTSEC-2026-0398) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | \`Seekable::decompress\` sets a \`Vec\` length beyond its capacity for offsets past the end | | [RUSTSEC-2026-0399](https://osv.dev/vulnerability/RUSTSEC-2026-0399) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free through \`init\_using\_cdict\` and \`init\_using\_ddict\` | | [RUSTSEC-2026-0400](https://osv.dev/vulnerability/RUSTSEC-2026-0400) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free of a dictionary after a one-shot call on a context with an open stream | | [RUSTSEC-2026-0401](https://osv.dev/vulnerability/RUSTSEC-2026-0401) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Out-of-bounds read in \`train\_from\_buffer\` when sample sizes overflow | | [RUSTSEC-2026-0402](https://osv.dev/vulnerability/RUSTSEC-2026-0402) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Heap buffer overflow in \`CCtx::try\_clone\` on a multithreaded context | | [RUSTSEC-2026-0403](https://osv.dev/vulnerability/RUSTSEC-2026-0403) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Uninitialized memory exposed when streaming decompression of a legacy frame fails | | [RUSTSEC-2026-0404](https://osv.dev/vulnerability/RUSTSEC-2026-0404) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Double free in \`DCtx::try\_clone\` | | [RUSTSEC-2026-0405](https://osv.dev/vulnerability/RUSTSEC-2026-0405) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Out-of-bounds read with an out-of-range \`InBuffer::pos\` | | [RUSTSEC-2026-0406](https://osv.dev/vulnerability/RUSTSEC-2026-0406) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free when changing a multithreaded context with an unfinished frame | | [RUSTSEC-2026-0410](https://osv.dev/vulnerability/RUSTSEC-2026-0410) | unknown | zstd-sys 2.0.16+zstd.1.5.7 (crates.io) | 2.1.2 | WebAssembly allocator shim corrupts memory on allocation failure | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/demoparser2@0.42.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/demoparser2/0.42.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/demoparser2/0.42.1