# SBOM for kestrel-native 0.1.9

> High-performance native extensions for Kestrel

The Python package kestrel-native 0.1.9 ships 30 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/kestrel-native@0.1.9`
- PyPI: https://pypi.org/project/kestrel-native/0.1.9/
- Requires Python: \<3.15,\>=3.10

## SBOMs

### kestrel\_native-0.1.9-cp310-cp310-macosx\_10\_12\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/d8768455-a606-51d4-9db7-19c896401391/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp310-cp310-macosx\_11\_0\_arm64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/eca8341b-e1ab-5c22-83a3-6941ac3a159f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp310-cp310-manylinux\_2\_12\_i686.manylinux2010\_i686.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/ba4bbbe5-63f6-5b99-8176-2fbea746ae24/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/4002b31c-bbe5-5cd3-910e-874b589af56b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp310-cp310-manylinux\_2\_28\_aarch64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/616d39ee-3bd2-5636-9efa-30b71abe3908/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp310-cp310-win\_amd64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/c773f0f1-97cd-52c3-a5e7-bc8ea4822e5f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp311-cp311-macosx\_10\_12\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/5ba31749-5711-53a2-8240-46c54decff98/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp311-cp311-macosx\_11\_0\_arm64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/a5ceb2f0-3499-52ae-8870-8312f1a01ed0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp311-cp311-manylinux\_2\_12\_i686.manylinux2010\_i686.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/193dadf9-8ae3-5811-9676-dfd115bb7cc1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/e7a71e03-1dc7-59f2-b68c-317515a06ad4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp311-cp311-manylinux\_2\_28\_aarch64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/fbdecba5-fc50-5fb5-93e4-08f575cc8a4e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp311-cp311-win\_amd64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/31e4d5dd-269b-54a3-8a40-d84420513863/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp312-cp312-macosx\_10\_12\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/a3aeb48b-60c2-5497-a989-6353a6a250c5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp312-cp312-macosx\_11\_0\_arm64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/92a9c905-cb81-5eaa-bd84-30f79145d554/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp312-cp312-manylinux\_2\_12\_i686.manylinux2010\_i686.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/c31ecf38-4360-539a-a5f7-fccb3345ec67/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/eea819d6-3442-5098-b4bb-e783b5c09b31/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp312-cp312-manylinux\_2\_28\_aarch64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/1aa61a11-ea94-508c-9411-a32b21d80321/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp312-cp312-win\_amd64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/433f4623-e201-50c5-bc26-78426a9f36e2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp313-cp313-macosx\_10\_12\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/acb96b46-f192-5cd4-b052-b4c19d21afc4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp313-cp313-macosx\_11\_0\_arm64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/a1c2553d-1bc6-5e96-b595-c265f245ad8f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp313-cp313-manylinux\_2\_12\_i686.manylinux2010\_i686.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/ef9dd7c0-b5ff-58aa-99d1-be4df702fdef/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/8e583d24-fc33-57aa-bb80-96909f3fdc46/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp313-cp313-manylinux\_2\_28\_aarch64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/69883ec4-79db-54e0-8666-e1a4f40fde1a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp313-cp313-win\_amd64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/14f175e7-8924-5fe0-8cb3-f7e6a3eef73c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp314-cp314-macosx\_10\_12\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/45421713-ae50-5c0c-b2bc-3b896144411e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp314-cp314-macosx\_11\_0\_arm64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/0ed9dad0-4184-505e-bbb9-b3131e75c6f4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp314-cp314-manylinux\_2\_12\_i686.manylinux2010\_i686.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/dd4cf600-22e2-5a04-9775-b0ba3c6df855/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/0c0317f8-80c0-5328-9699-ac955c93c004/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp314-cp314-manylinux\_2\_28\_aarch64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/c04cd8aa-77fb-5751-b328-5ca42bd49eb7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### kestrel\_native-0.1.9-cp314-cp314-win\_amd64.whl

- [kestrel\_native-0.1.9.dist-info/sboms/kestrel-native.cyclonedx.json](https://pypi.sbomify.com/artifact/de30e29e-80f3-5b8e-b84f-986aed02bc6f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/kestrel-native@0.1.9
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/kestrel-native/0.1.9.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/kestrel-native/0.1.9