# SBOM for kwimage-ext 0.4.1

> Binary acceleration extensions for kwimage

The Python package kwimage-ext 0.4.1 ships 9 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/kwimage-ext@0.4.1`
- PyPI: https://pypi.org/project/kwimage-ext/0.4.1/
- Author: Kitware Inc.
- Requires Python: \>=3.10
- Documentation: <https://kwimage_ext.readthedocs.io>
- Homepage: <https://gitlab.kitware.com/computer-vision/kwimage_ext>

## SBOMs

### kwimage\_ext-0.4.1-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/806eec02-5360-58b9-b5df-701d74b54ae8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kwimage\_ext-0.4.1-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/a5feb323-2e22-51fa-86bf-d2142546a400/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kwimage\_ext-0.4.1-cp310-abi3-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/8c909028-b235-501c-ad07-5fcb3e4f4453/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kwimage\_ext-0.4.1-cp310-abi3-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/ea7d1e64-cda8-55cf-ad4a-570970d69860/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kwimage\_ext-0.4.1-cp310-abi3-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/a39b8160-109c-5841-837b-48b4593b7a74/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/9f69d2ef-f4ae-59bf-bb9c-615714232199/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kwimage\_ext-0.4.1-cp310-abi3-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/869d04c2-f849-504d-9628-e6e9d8ecc54d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/c43f464f-682f-58b7-bd01-8deab09c728d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

### kwimage\_ext-0.4.1-cp310-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, Erotemic/kwimage\_ext, workflow release.yml).

- [kwimage\_ext-0.4.1.dist-info/sboms/kwimage\_ext.cyclonedx.json](https://pypi.sbomify.com/artifact/8b3d896c-de14-5397-8660-da2aed6b3127/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [GHSA-36hh-v3qg-5jq4](https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4) | high (8.7) | pyo3 0.22.6 (crates.io) | 0.29.0 | PyO3 has an Out-of-bounds Read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.22.6 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2025-0020](https://osv.dev/vulnerability/RUSTSEC-2025-0020) | low (2.9) | pyo3 0.22.6 (crates.io) | 0.24.1 | Risk of buffer overflow in \`PyString::from\_object\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/kwimage-ext@0.4.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/kwimage-ext/0.4.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/kwimage-ext/0.4.1