# SBOM for keeper-pam-webrtc-rs 2.2.13

> Keeper PAM WebRTC for Python - A secure, stable, and high-performance Tube API for Python, providing WebRTC-based secure tunneling with enterprise-grade security and reliability optimizations.

The Python package keeper-pam-webrtc-rs 2.2.13 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/keeper-pam-webrtc-rs@2.2.13`
- PyPI: https://pypi.org/project/keeper-pam-webrtc-rs/2.2.13/
- License: MIT
- Requires Python: \>=3.8

## SBOMs

### keeper\_pam\_webrtc\_rs-2.2.13-cp38-abi3-macosx\_10\_12\_x86\_64.whl

- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json](https://pypi.sbomify.com/artifact/bc49d842-0083-5d65-84ff-b34be26b0a98/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 42 known vulnerabilities

### keeper\_pam\_webrtc\_rs-2.2.13-cp38-abi3-macosx\_11\_0\_arm64.whl

- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json](https://pypi.sbomify.com/artifact/196525c5-5ec9-5c24-988e-8e993b00240d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 42 known vulnerabilities

### keeper\_pam\_webrtc\_rs-2.2.13-cp38-abi3-manylinux\_2\_28\_aarch64.whl

- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json](https://pypi.sbomify.com/artifact/db3cc26b-73e7-5521-a163-f9de248c80fc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 44 known vulnerabilities

### keeper\_pam\_webrtc\_rs-2.2.13-cp38-abi3-manylinux\_2\_28\_x86\_64.whl

- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json](https://pypi.sbomify.com/artifact/027d6433-8b32-5b80-ac3f-cbc16d5c5bc6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 44 known vulnerabilities

### keeper\_pam\_webrtc\_rs-2.2.13-cp38-abi3-musllinux\_1\_2\_x86\_64.whl

- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/51f4e42f-772b-5eb8-99e8-2183b913f674/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a599aa5a-f4ee-5ca3-bc77-3331a7e6d351/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 44 known vulnerabilities

### keeper\_pam\_webrtc\_rs-2.2.13-cp38-abi3-win\_amd64.whl

- [keeper\_pam\_webrtc\_rs-2.2.13.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a6b3bccb-4d84-5056-9d4c-e43e954a1fd2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 43 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-123607](https://insights.sbomify.com/CVE-2026-123607/) | high (8.7) | hickory-proto 0.25.2 (crates.io) | 0.26.0-beta.1 | NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses |
| [CVE-2026-123604](https://insights.sbomify.com/CVE-2026-123604/) | high (8.7) | hickory-resolver 0.26.1 (crates.io) | 0.26.2 | hickory-resolver: Unbounded TC-retry loop in \`NameServerPool::try\_send\` (resource-exhaustion DoS) |
| [CVE-2026-116794](https://insights.sbomify.com/CVE-2026-116794/) | high (8.3) | russh 0.46.0 (crates.io) | 0.65 | russh: Agent server never calls \`Agent::confirm\`, so keys added with the confirm constraint (\`ssh-add -c\`) sign without confirmation |
| [CVE-2026-93657](https://insights.sbomify.com/CVE-2026-93657/) | high (7.5) | hickory-resolver 0.25.2 (crates.io) | 0.26.2 | hickory-resolver: Resolver::lookup() and Resolver::lookup\_ip() APIs obscure DNSSEC validation failures |
| [CVE-2026-93657](https://insights.sbomify.com/CVE-2026-93657/) | high (7.5) | hickory-resolver 0.26.1 (crates.io) | 0.26.2 | hickory-resolver: Resolver::lookup() and Resolver::lookup\_ip() APIs obscure DNSSEC validation failures |
| [CVE-2026-102823](https://insights.sbomify.com/CVE-2026-102823/) | high (7.5) | russh 0.46.0 (crates.io) | 0.63.1 | russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened |
| [CVE-2026-42189](https://insights.sbomify.com/CVE-2026-42189/) | high (7.5) | russh 0.46.0 (crates.io) | 0.60.1 | russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler |
| [CVE-2026-46673](https://insights.sbomify.com/CVE-2026-46673/) | high (7.5) | russh 0.46.0 (crates.io) | 0.60.3 | Unbounded 32-bit allocation |
| [CVE-2026-46702](https://insights.sbomify.com/CVE-2026-46702/) | high (7.5) | russh 0.46.0 (crates.io) | 0.61.1 | russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets |
| [CVE-2026-48110](https://insights.sbomify.com/CVE-2026-48110/) | high (7.5) | russh 0.46.0 (crates.io) | 0.61.0 | Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds |
| [CVE-2026-46673](https://insights.sbomify.com/CVE-2026-46673/) | high (7.5) | russh-cryptovec 0.7.3 (crates.io) | 0.60.3 | Unchecked \`CryptoVec\` allocation and growth handling |
| [CVE-2026-123608](https://insights.sbomify.com/CVE-2026-123608/) | medium (6.9) | hickory-proto 0.25.2 (crates.io) | 0.26.1 | CPU exhaustion during message encoding due to O(n²) name compression |
| [CVE-2026-123585](https://insights.sbomify.com/CVE-2026-123585/) | medium (6.9) | hickory-resolver 0.25.2 (crates.io) | 0.26.2 | hickory-resolver follows irrelevant CNAME records |
| [CVE-2026-123585](https://insights.sbomify.com/CVE-2026-123585/) | medium (6.9) | hickory-resolver 0.26.1 (crates.io) | 0.26.2 | hickory-resolver follows irrelevant CNAME records |
| [CVE-2026-119375](https://insights.sbomify.com/CVE-2026-119375/) | medium (6.8) | libsqlite3-sys 0.30.1 (crates.io) | 0.39.0 | \`libsqlite3-sys\` via C SQLite CVE-2026-119375 |
| [CVE-2025-54804](https://insights.sbomify.com/CVE-2025-54804/) | medium (6.5) | russh 0.46.0 (crates.io) | 0.54.1 | russh is missing overflow checks during channel windows adjust |
| [CVE-2026-102821](https://insights.sbomify.com/CVE-2026-102821/) | medium (6.5) | russh 0.46.0 (crates.io) | 0.63.2 | Russh: Unbounded memory exhaustion via CHANNEL\_OPEN flood during a client-stalled rekey |
| [CVE-2026-48107](https://insights.sbomify.com/CVE-2026-48107/) | medium (6.5) | russh 0.46.0 (crates.io) | 0.61.0 | Russh: Unchecked keyboard-interactive prompt count in client auth path |
| [CVE-2026-68930](https://insights.sbomify.com/CVE-2026-68930/) | medium (6.5) | russh 0.46.0 (crates.io) | 0.62.5 | Russh: Channel-scoped server callbacks can be reached without an open channel |
| [CVE-2026-102820](https://insights.sbomify.com/CVE-2026-102820/) | medium (6.2) | pageant 0.0.1 (crates.io) | 0.2.3 | pageant: Out-of-bounds read / oversized allocation in \`pageant\` MemoryMap::read via a malicious Pageant agent (Windows) |
| [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/) | medium (5.9) | rsa 0.10.0-rc.18 (crates.io) | 0.10.0 | Marvin Attack: potential key recovery through timing sidechannels |
| [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/) | medium (5.9) | rsa 0.9.10 (crates.io) | 0.10.0 | Marvin Attack: potential key recovery through timing sidechannels |
| [CVE-2026-46705](https://insights.sbomify.com/CVE-2026-46705/) | medium (5.3) | russh 0.46.0 (crates.io) | 0.61.0 | russh server userauth state is not reset when authentication principal changes |
| [CVE-2026-48108](https://insights.sbomify.com/CVE-2026-48108/) | medium (5.3) | russh 0.46.0 (crates.io) | 0.61.0 | Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input |
| [CVE-2026-73429](https://insights.sbomify.com/CVE-2026-73429/) | medium (5.3) | russh 0.46.0 (crates.io) | 0.62.4 | Russh: client wrong-length X25519 \`clone\_from\_slice\` panic (pre-auth DoS) |
| [CVE-2026-73430](https://insights.sbomify.com/CVE-2026-73430/) | medium (5.3) | russh 0.46.0 (crates.io) | 0.62.4 | Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode\_mpint OOB) |
| [CVE-2026-102824](https://insights.sbomify.com/CVE-2026-102824/) | medium (4.3) | russh 0.46.0 (crates.io) | 0.63.0 | Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange |
| [CVE-2026-111061](https://insights.sbomify.com/CVE-2026-111061/) | medium (4.3) | russh 0.46.0 (crates.io) | 0.64.1 | russh: Unbounded memory allocation in agent protocol server via crafted constraint records |
| [CVE-2026-116773](https://insights.sbomify.com/CVE-2026-116773/) | medium (4.3) | russh 0.46.0 (crates.io) | 0.65 | russh's SSH client is susceptible to unbounded allocations via EXT\_INFO packets |
| [CVE-2026-73489](https://insights.sbomify.com/CVE-2026-73489/) | medium (4.3) | russh 0.46.0 (crates.io) | 0.62.4 | Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records |
| [CVE-2026-102822](https://insights.sbomify.com/CVE-2026-102822/) | low (3.7) | russh 0.46.0 (crates.io) | 0.63.1 | russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic |
| [CVE-2026-102825](https://insights.sbomify.com/CVE-2026-102825/) | low (3.7) | russh 0.46.0 (crates.io) | 0.62.6 | Russh: Configured server auth-attempt cap is not enforced in the USERAUTH\_REQUEST runtime path |
| [CVE-2026-116696](https://insights.sbomify.com/CVE-2026-116696/) | low (3.3) | russh 0.46.0 (crates.io) | 0.65.0 | russh's SSH agent server is susceptible to unbound allocations via repeated SSH\_AGENT\_CONSTRAIN\_CONFIRM messages |
| [CVE-2026-111062](https://insights.sbomify.com/CVE-2026-111062/) | low (2.3) | russh 0.46.0 (crates.io) | 0.64.0 | A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request |
| [RUSTSEC-2025-0052](https://osv.dev/vulnerability/RUSTSEC-2025-0052) | unknown | async-std 1.13.2 (crates.io) | none listed | async-std has been discontinued |
| [RUSTSEC-2023-0089](https://osv.dev/vulnerability/RUSTSEC-2023-0089) | unknown | atomic-polyfill 1.0.3 (crates.io) | none listed | atomic-polyfill is unmaintained |
| [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained |
| [RUSTSEC-2026-0387](https://osv.dev/vulnerability/RUSTSEC-2026-0387) | unknown | crypto-bigint 0.5.5 (crates.io) | 0.7.6 | Multiple timing variability issues in operations intended to be constant-time |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.7.3 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |
| [RUSTSEC-2026-0235](https://osv.dev/vulnerability/RUSTSEC-2026-0235) | unknown | rkyv 0.7.46 (crates.io) | 0.8.17 | Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc |
| [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.53.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety |
| [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.25.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/keeper-pam-webrtc-rs@2.2.13
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/keeper-pam-webrtc-rs/2.2.13.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/keeper-pam-webrtc-rs/2.2.13