# SBOM for hpke-http 4.0.1

> HPKE-protected HTTP requests and checked live response records backed by Rust.

The Python package hpke-http 4.0.1 ships 3 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/hpke-http@4.0.1`
- PyPI: https://pypi.org/project/hpke-http/4.0.1/
- Author: Duale AI
- Requires Python: \>=3.10
- Changelog: <https://github.com/dualeai/hpke-http/releases>
- Documentation: <https://github.com/dualeai/hpke-http#readme>
- Homepage: <https://github.com/dualeai/hpke-http>
- Issues: <https://github.com/dualeai/hpke-http/issues>
- Repository: <https://github.com/dualeai/hpke-http.git>

## SBOMs

### hpke\_http-4.0.1-cp310-abi3-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl

PEP 740 attestation verified (GitHub, dualeai/hpke-http, workflow release.yml).

- [hpke\_http-4.0.1.dist-info/sboms/hpke-http-py.cyclonedx.json](https://pypi.sbomify.com/artifact/f54950b7-1031-58df-9913-2e612ad4b4e3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### hpke\_http-4.0.1-cp310-abi3-manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, dualeai/hpke-http, workflow release.yml).

- [hpke\_http-4.0.1.dist-info/sboms/hpke-http-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3085c6a0-8e12-5898-b45d-21d318c80656/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

### hpke\_http-4.0.1-cp310-abi3-manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, dualeai/hpke-http, workflow release.yml).

- [hpke\_http-4.0.1.dist-info/sboms/hpke-http-py.cyclonedx.json](https://pypi.sbomify.com/artifact/baa31745-97f6-576f-84b5-45de96a7c4ec/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 2 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0344](https://osv.dev/vulnerability/RUSTSEC-2026-0344) | high (7.5) | ruzstd 0.9.0 (crates.io) | 0.9.1 | Decompression bomb in \`ruzstd\`: a tiny input can exhaust memory (OOM) |
| [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.2 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/hpke-http@4.0.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/hpke-http/4.0.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/hpke-http/4.0.1