# SBOM for django-bolt 0.13.0 > The fastest Python web framework, built on Django: Rust (Actix Web) HTTP server, async typed handlers, msgspec validation - with the full Django ORM, Admin, middleware and auth. 300k+ req/s, no gunicorn or uvicorn needed. The Python package django-bolt 0.13.0 ships 10 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/django-bolt@0.13.0` - PyPI: https://pypi.org/project/django-bolt/0.13.0/ - License: MIT - Requires Python: \>=3.12 - Bug Tracker: - Documentation: - Homepage: - Repository: ## SBOMs ### django\_bolt-0.13.0-cp312-abi3-macosx\_10\_12\_x86\_64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/860f940f-a7a3-5659-94c3-dc3d16aa932e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp312-abi3-macosx\_11\_0\_arm64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/b6d477f4-80fa-595d-ba63-8b676c491651/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp312-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/ba6feec0-2359-5a51-b554-1dbbd19c61c3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp312-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/e3461b9b-28c8-5e24-8a5d-ceea8ed25c05/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp312-abi3-win\_amd64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/e9ed5304-18bb-5f42-87f3-7b0aa468d6eb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp314-cp314t-macosx\_10\_12\_x86\_64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/cbf01b18-15aa-5024-9970-de0cfc91eea2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp314-cp314t-macosx\_11\_0\_arm64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/77c6b75f-5804-56ee-bbef-aa3824f30b48/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp314-cp314t-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/59f3ae9f-4fd0-5d75-ae4b-850cecd58b88/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp314-cp314t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/15896a3a-a27c-5715-bb53-7deb8d546ffe/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ### django\_bolt-0.13.0-cp314-cp314t-win\_amd64.whl - [django\_bolt-0.13.0.dist-info/sboms/django-bolt.cyclonedx.json](https://pypi.sbomify.com/artifact/4666627a-7038-5fc4-83ed-9b5f4f70528f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0461](https://osv.dev/vulnerability/RUSTSEC-2026-0461) | high (7.5) | rmcp 3.5.1 (crates.io) | 3.6.0 | Unbounded tool schema cache in Streamable HTTP server transport | | [RUSTSEC-2026-0462](https://osv.dev/vulnerability/RUSTSEC-2026-0462) | medium (6.5) | rmcp 3.5.1 (crates.io) | 3.9.0 | Unbounded response body buffering in Streamable HTTP clients | | [RUSTSEC-2026-0443](https://osv.dev/vulnerability/RUSTSEC-2026-0443) | unknown | actix-files 0.7.1 (crates.io) | 0.7.4 | Hidden file disclosure through Windows short names | | [RUSTSEC-2026-0446](https://osv.dev/vulnerability/RUSTSEC-2026-0446) | unknown | actix-http 3.19.0 (crates.io) | 3.20.2 | Request smuggling through malformed chunked request trailers | | [RUSTSEC-2026-0448](https://osv.dev/vulnerability/RUSTSEC-2026-0448) | unknown | actix-http 3.19.0 (crates.io) | 3.20.1 | Unbounded decompression can exhaust memory and CPU resources | | [RUSTSEC-2026-0455](https://osv.dev/vulnerability/RUSTSEC-2026-0455) | unknown | actix-http 3.19.0 (crates.io) | 3.20.3 | Large-window Brotli bodies bypass decompression memory limits | | [RUSTSEC-2026-0447](https://osv.dev/vulnerability/RUSTSEC-2026-0447) | unknown | actix-web 4.17.0 (crates.io) | 4.18.2 | Compressed request bodies can exhaust memory before extractor limits apply | | [RUSTSEC-2026-0258](https://osv.dev/vulnerability/RUSTSEC-2026-0258) | unknown | h2 0.3.27 (crates.io) | 0.4.16 | h2 unbounded empty DATA frames | | [RUSTSEC-2026-0457](https://osv.dev/vulnerability/RUSTSEC-2026-0457) | unknown | rmcp 3.5.1 (crates.io) | 3.7.0 | OAuth client SSRF filter checks host strings, not resolved addresses | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/django-bolt@0.13.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/django-bolt/0.13.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/django-bolt/0.13.0