SBOM for iam-policy-autopilot 0.4.0
An open source Model Context Protocol (MCP) server and command-line tool that helps your AI coding assistants quickly create baseline IAM policies that you can refine as your application evolves, so you can build faster. IAM Policy Autopilot analyzes your application code locally to generate identity-based policies for application roles, enabling faster IAM policy creation and reducing access troubleshooting time. IAM Policy Autopilot supports applications built in Python, Go, TypeScript, and Java.
Package information
Available SBOMs
Read from .dist-info/sboms/ in each wheel.
iam_policy_autopilot-0.4.0-py3-none-macosx_10_12_x86_64.whl
Attested
Valid
Download
iam-policy-autopilot-cli.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
iam_policy_autopilot-0.4.0-py3-none-macosx_11_0_arm64.whl
Attested
Valid
Download
iam-policy-autopilot-cli.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
iam_policy_autopilot-0.4.0-py3-none-manylinux2014_aarch64.manylinux_2_17_aarch64.whl
Attested
Valid
Download
iam-policy-autopilot-cli.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
iam_policy_autopilot-0.4.0-py3-none-manylinux2014_x86_64.manylinux_2_17_x86_64.whl
Attested
Valid
Download
iam-policy-autopilot-cli.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
iam_policy_autopilot-0.4.0-py3-none-win_amd64.whl
Attested
Valid
Download
iam-policy-autopilot-cli.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
iam_policy_autopilot-0.4.0-py3-none-win_arm64.whl
Attested
Valid
Download
iam-policy-autopilot-cli.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
Known vulnerabilities
Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in |
|---|---|---|---|
|
CVE-2026-18140
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
|
High 8.7 | aws-smithy-json 0.62.5 crates.io |
0.62.7 |
|
CVE-2026-63127
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
|
High 8.2 | rmcp 1.7.0 crates.io |
2.0.0 |
|
RUSTSEC-2026-0340
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
|
High 7.5 | quinn-proto 0.11.15 crates.io |
0.11.18 |
|
RUSTSEC-2026-0341
Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
|
High 7.5 | quinn-proto 0.11.15 crates.io |
0.11.17 |
|
CVE-2026-63128
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
|
High 7.5 | rmcp 1.7.0 crates.io |
2.0.0 |
|
CVE-2026-93599
Reachable panic in certificate revocation list parsing
|
High 7.5 | rustls-webpki 0.101.7 crates.io |
0.103.13 |
|
CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targets
|
Medium 6.8 | rmcp 1.7.0 crates.io |
2.1.0 |
|
RUSTSEC-2026-0462
Unbounded response body buffering in Streamable HTTP clients
|
Medium 6.5 | rmcp 1.7.0 crates.io |
3.9.0 |
|
GHSA-qwgh-2vcv-g2f7
block_buffer: panic corrupts inline buffer position
|
Medium 6.3 | block-buffer 0.12.0 crates.io |
— |
|
GHSA-c9xm-49cp-xcr9
rmcp OAuth client fetches server-controlled resource_metadata URLs
|
Medium 6.3 | rmcp 1.7.0 crates.io |
2.0.0 |
|
CVE-2026-50185
Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
|
Medium 5.5 | cmov 0.5.3 crates.io |
0.5.4 |
|
CVE-2026-123613
TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
|
Medium 5.3 | rustls 0.23.40 crates.io |
0.23.45 |
|
CVE-2026-123609
`Debug` impls for client session values expose TLS secrets
|
Medium 4.0 | rustls 0.21.12 crates.io |
0.23.46 |
|
CVE-2026-123609
`Debug` impls for client session values expose TLS secrets
|
Medium 4.0 | rustls 0.23.40 crates.io |
0.23.46 |
|
CVE-2026-123610
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
|
Low 3.7 | rustls 0.21.12 crates.io |
0.23.46 |
|
CVE-2026-123610
Brotli certificate decompression can allocate up to 1 GiB before authentication
|
Low 3.7 | rustls 0.23.40 crates.io |
0.23.46 |
|
CVE-2026-123611
Unauthenticated ServerHello can downgrade later connections to classical key exchange
|
Low 3.7 | rustls 0.21.12 crates.io |
0.23.46 |
|
CVE-2026-123611
Unauthenticated ServerHello can downgrade later connections to classical key exchange
|
Low 3.7 | rustls 0.23.40 crates.io |
0.23.46 |
|
CVE-2026-93600
Name constraints for URI names were incorrectly accepted
|
Low 2.2 | rustls-webpki 0.101.7 crates.io |
0.103.12 |
|
CVE-2026-93601
Name constraints were accepted for certificates asserting a wildcard name
|
Low 2.2 | rustls-webpki 0.101.7 crates.io |
0.103.12 |
|
RUSTSEC-2026-0190
Unsoundness in `Error::downcast_mut()`
|
Unknown | anyhow 1.0.102 crates.io |
1.0.103 |
|
RUSTSEC-2026-0204
Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
|
Unknown | crossbeam-epoch 0.9.18 crates.io |
0.9.20 |
|
RUSTSEC-2026-0387
Multiple timing variability issues in operations intended to be constant-time
|
Unknown | crypto-bigint 0.4.9 crates.io |
0.7.6 |
|
RUSTSEC-2026-0387
Multiple timing variability issues in operations intended to be constant-time
|
Unknown | crypto-bigint 0.5.5 crates.io |
0.7.6 |
|
RUSTSEC-2026-0385
Non-constant-time mask generation and `u128` comparisons
|
Unknown | ctutils 0.4.2 crates.io |
0.4.4 |
|
RUSTSEC-2026-0183
Potential undefined behavior when calling Remote::list()
|
Unknown | git2 0.20.4 crates.io |
0.21.0 |
|
RUSTSEC-2026-0184
Potential undefined behavior with Signature from a buffer-created BlameHunk
|
Unknown | git2 0.20.4 crates.io |
0.21.0 |
|
RUSTSEC-2026-0258
h2 unbounded empty DATA frames
|
Unknown | h2 0.3.27 crates.io |
0.4.16 |
|
RUSTSEC-2026-0258
h2 unbounded empty DATA frames
|
Unknown | h2 0.4.14 crates.io |
0.4.16 |
|
RUSTSEC-2026-0418
libz-sys build script leaks environment variables in the build directory
|
Unknown | libz-sys 1.1.28 crates.io |
1.1.31 |
|
RUSTSEC-2026-0441
`pin-utils` is unmaintained
|
Unknown | pin-utils 0.1.0 crates.io |
— |
|
RUSTSEC-2026-0173
proc-macro-error2 is unmaintained
|
Unknown | proc-macro-error2 2.0.1 crates.io |
— |
|
RUSTSEC-2026-0338
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
|
Unknown | quinn-proto 0.11.15 crates.io |
0.11.18 |
|
RUSTSEC-2026-0339
Unbounded growth of pending connection ID retirements in quinn-proto
|
Unknown | quinn-proto 0.11.15 crates.io |
0.11.17 |
|
RUSTSEC-2026-0342
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
|
Unknown | quinn-proto 0.11.15 crates.io |
0.11.17 |
|
CVE-2026-111943
Certificate verification may accept distrusted intermediates
|
Unknown | rustls-webpki 0.101.7 crates.io |
0.103.16 |
|
CVE-2026-111943
Certificate verification may accept distrusted intermediates
|
Unknown | rustls-webpki 0.103.13 crates.io |
0.103.16 |
|
RUSTSEC-2026-0386
`AsyncFd::new` and related constructors violate I/O safety
|
Unknown | tokio 1.52.3 crates.io |
1.53.3 |
|
RUSTSEC-2024-0449
unsafe-libyaml is unmaintained
|
Unknown | unsafe-libyaml 0.2.11 crates.io |
— |
|
RUSTSEC-2026-0391
Data from an abandoned stream leaks into the next stream on a reused context
|
Unknown | zstd 0.13.3 crates.io |
0.13.4 |
|
RUSTSEC-2026-0395
Use-after-free with `CParameter::StableInBuffer`
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0396
`Seekable` reads a NULL or out-of-bounds seek table
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0397
`OutBuffer::around_pos` exposes uninitialized memory
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0398
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0399
Use-after-free through `init_using_cdict` and `init_using_ddict`
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0400
Use-after-free of a dictionary after a one-shot call on a context with an open stream
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0401
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0402
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0403
Uninitialized memory exposed when streaming decompression of a legacy frame fails
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0404
Double free in `DCtx::try_clone`
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0405
Out-of-bounds read with an out-of-range `InBuffer::pos`
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0406
Use-after-free when changing a multithreaded context with an unfinished frame
|
Unknown | zstd-safe 7.2.4 crates.io |
7.4.0 |
|
RUSTSEC-2026-0410
WebAssembly allocator shim corrupts memory on allocation failure
|
Unknown | zstd-sys 2.0.16+zstd.1.5.7 crates.io |
2.1.2 |
Access via TEA
Use the Transparency Exchange API to fetch this SBOM programmatically:
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]