# SBOM for klvm-rs 0.19.0 > Implementation of \`klvm\` for Chik Network's cryptocurrency The Python package klvm-rs 0.19.0 ships 7 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/klvm-rs@0.19.0` - PyPI: https://pypi.org/project/klvm-rs/0.19.0/ - Author: Richard Kiss \ - License: Apache-2.0 - Homepage: - Source Code: ## SBOMs ### klvm\_rs-0.19.0-cp310-abi3-macosx\_15\_0\_arm64.whl PEP 740 attestation verified (GitHub, Chik-Network/klvm\_rs, workflow build-m1-wheel.yml). - [klvm\_rs-0.19.0.dist-info/sboms/klvm\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/2dee8de7-3fb9-584f-8492-ff72ade05bc9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### klvm\_rs-0.19.0-cp310-abi3-macosx\_15\_0\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/klvm\_rs, workflow build-test.yml). - [klvm\_rs-0.19.0.dist-info/sboms/klvm\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/93f267b7-46f5-5933-ab3d-287a30f5e81e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### klvm\_rs-0.19.0-cp310-abi3-manylinux\_2\_28\_aarch64.whl PEP 740 attestation verified (GitHub, Chik-Network/klvm\_rs, workflow build-arm64-wheels.yml). - [klvm\_rs-0.19.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0fdad7b0-6479-5cd0-9ba6-eec48cd795b2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [klvm\_rs-0.19.0.dist-info/sboms/klvm\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/e5432b58-3db3-5169-ad63-29b94f33b58d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### klvm\_rs-0.19.0-cp310-abi3-manylinux\_2\_28\_x86\_64.whl PEP 740 attestation verified (GitHub, Chik-Network/klvm\_rs, workflow build-test.yml). - [klvm\_rs-0.19.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2ae53d8e-c37c-57c0-8929-4048675d9d55/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities - [klvm\_rs-0.19.0.dist-info/sboms/klvm\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/df291fde-770a-5071-a8b6-3c924385e9aa/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 13 known vulnerabilities ### klvm\_rs-0.19.0-cp310-abi3-win\_amd64.whl PEP 740 attestation verified (GitHub, Chik-Network/klvm\_rs, workflow build-test.yml). - [klvm\_rs-0.19.0.dist-info/sboms/klvm\_rs.cyclonedx.json](https://pypi.sbomify.com/artifact/bbb7550e-145c-53fe-8ce3-bcfdc138330b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.72 (crates.io) | 0.10.79 | \`X509Ref::ocsp\_responders\` can produce a \`&str\` that is not valid UTF-8 | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.72 (crates.io) | 0.10.78 | Unchecked callback lengths in PSK and cookie callbacks | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.72 (crates.io) | 0.10.78 | Buffer overflow in \`MdCtxRef::digest\_final\` | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.72 (crates.io) | 0.10.78 | Buffer overflow in \`Deriver::derive\` and \`PkeyCtxRef::derive\` with OpenSSL 1.1.x | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.72 (crates.io) | 0.10.78 | Out-of-bounds write in \`aes::unwrap\_key\` | | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [CVE-2026-50185](https://insights.sbomify.com/CVE-2026-50185/) | medium (5.5) | cmov 0.5.3 (crates.io) | 0.5.4 | Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.72 (crates.io) | 0.10.79 | Buffer overflow with AES key wrap with padding in \`cipher\_update\` | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.72 (crates.io) | 0.10.80 | Buffer overflow with AES key wrap with padding in \`cipher\_update\_inplace\` | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.72 (crates.io) | 0.10.78 | Out-of-bounds read when a PEM password callback returns an oversized length | | [RUSTSEC-2026-0387](https://osv.dev/vulnerability/RUSTSEC-2026-0387) | unknown | crypto-bigint 0.7.5 (crates.io) | 0.7.6 | Multiple timing variability issues in operations intended to be constant-time | | [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.2 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/klvm-rs@0.19.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/klvm-rs/0.19.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/klvm-rs/0.19.0