# SBOM for kernels 0.18.1 > Download compute kernels The Python package kernels 0.18.1 ships 29 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/kernels@0.18.1` - PyPI: https://pypi.org/project/kernels/0.18.1/ - License: Apache-2.0 - Requires Python: \>=3.10 - Homepage: ## SBOMs ### kernels-0.18.1-cp314-cp314t-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/193bfcae-343a-5abc-a018-a4ca28b3ee08/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/44bcbd83-53cc-5850-a420-49aba6f08c05/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-manylinux1\_i686.manylinux\_2\_5\_i686.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9d598557-0dd5-5c44-bf23-45dfcb58a037/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/69925b75-812d-5525-af92-172e34616c5b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-manylinux2014\_armv7l.manylinux\_2\_17\_armv7l.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/1d0dff29-7c28-5ef2-b9c3-83c3b039d980/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-manylinux2014\_ppc64le.manylinux\_2\_17\_ppc64le.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/dc2075c3-2703-5f90-8e15-f697454388a8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-manylinux2014\_s390x.manylinux\_2\_17\_s390x.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/7da73f1b-a0b6-5466-a1c0-837dd8f78070/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/dbdac442-b0f5-5364-8b01-20f4fa3d28eb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/ee92a2eb-4316-5421-ab98-ca1bc03db34b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-musllinux\_1\_2\_armv7l.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/6a7320b6-e0b7-526f-a08a-dfc31857cf9f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-musllinux\_1\_2\_i686.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d301a825-16d5-5562-ac30-72dc47462275/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a096191f-781a-558d-9980-d47766a6f2be/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-win32.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/cd2b073a-881e-5e7d-9499-368103ec108b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp314-cp314t-win\_amd64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/6df51eb8-24a9-5313-8066-14c03fa506e3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/1c3cce54-6a90-5b0b-b768-3210774ae92b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/4de67f7e-c058-54db-8025-fadc04bc065c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-manylinux1\_i686.manylinux\_2\_5\_i686.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/9f4acfce-5e9c-53f7-9c79-0544fb9cfa06/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/ba9ab13a-34e6-54d2-9ae7-0542fd6c9de7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-manylinux2014\_armv7l.manylinux\_2\_17\_armv7l.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/983a07a6-a1b8-58d6-9bc4-34dd53d19ace/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-manylinux2014\_ppc64le.manylinux\_2\_17\_ppc64le.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/4bb79bf7-92de-504e-aa15-c821bca9fd3a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-manylinux2014\_s390x.manylinux\_2\_17\_s390x.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/fc7caf0b-39c2-5bec-91ad-4629d076072e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a1d1f30f-17b3-5e6c-89d9-d425bd14864e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-musllinux\_1\_2\_aarch64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a7778900-ae4e-5ddc-9dba-4a4215028ba9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-musllinux\_1\_2\_armv7l.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/e89bce59-1efe-5c27-b2f8-6749e378fee8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-musllinux\_1\_2\_i686.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/a1a3ef2f-0348-5fd0-8694-9ceacea4572d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-musllinux\_1\_2\_x86\_64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/e0bf73e8-9c0d-5ea2-9c7a-904ff2445505/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-win32.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/d33e5084-c9b8-5b38-a191-a3fa27961c7d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-win\_amd64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/69cdb574-f844-5f2e-bab2-6c12070f8913/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ### kernels-0.18.1-cp38-abi3-win\_arm64.whl PEP 740 attestation verified (GitHub, huggingface/kernels, workflow publish\_kernels.yml). - [kernels-0.18.1.dist-info/sboms/kernels-python.cyclonedx.json](https://pypi.sbomify.com/artifact/7114ddba-7168-55b9-a826-3fba37fc8f49/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.26.0 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [CVE-2026-25800](https://insights.sbomify.com/CVE-2026-25800/) | high (7.5) | quinn-proto 0.11.14 (crates.io) | 0.11.15 | Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly | | [RUSTSEC-2026-0340](https://osv.dev/vulnerability/RUSTSEC-2026-0340) | high (7.5) | quinn-proto 0.11.14 (crates.io) | 0.11.18 | Peer minimum ACK delay can panic quinn-proto when ACK\_FREQUENCY transmission is enabled | | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.26.0 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [CVE-2026-123613](https://insights.sbomify.com/CVE-2026-123613/) | medium (5.3) | rustls 0.23.40 (crates.io) | 0.23.45 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.40 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.40 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.40 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [RUSTSEC-2026-0258](https://osv.dev/vulnerability/RUSTSEC-2026-0258) | unknown | h2 0.4.13 (crates.io) | 0.4.16 | h2 unbounded empty DATA frames | | [RUSTSEC-2026-0338](https://osv.dev/vulnerability/RUSTSEC-2026-0338) | unknown | quinn-proto 0.11.14 (crates.io) | 0.11.18 | Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads | | [RUSTSEC-2026-0339](https://osv.dev/vulnerability/RUSTSEC-2026-0339) | unknown | quinn-proto 0.11.14 (crates.io) | 0.11.17 | Unbounded growth of pending connection ID retirements in quinn-proto | | [RUSTSEC-2026-0342](https://osv.dev/vulnerability/RUSTSEC-2026-0342) | unknown | quinn-proto 0.11.14 (crates.io) | 0.11.17 | Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.52.1 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/kernels@0.18.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/kernels/0.18.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/kernels/0.18.1