# SBOM for listen2-rust 3.0.6

The Python package listen2-rust 3.0.6 ships 1 SBOM file (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/listen2-rust@3.0.6`
- PyPI: https://pypi.org/project/listen2-rust/3.0.6/
- Requires Python: \>=3.8

## SBOMs

### listen2\_rust-3.0.6-cp314-cp314-manylinux\_2\_31\_aarch64.whl

- [listen2\_rust-3.0.6.dist-info/sboms/listen2\_rust.cyclonedx.json](https://pypi.sbomify.com/artifact/c87a3947-e8a1-53c3-9271-2e0ec933c68e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 9 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.78 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs |
| [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.78 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding |
| [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.78 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers |
| [RUSTSEC-2026-0002](https://osv.dev/vulnerability/RUSTSEC-2026-0002) | low (2.7) | lru 0.12.5 (crates.io) | 0.16.3 | \`IterMut\` violates Stacked Borrows by invalidating internal pointer |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.28 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory |
| [RUSTSEC-2026-0253](https://osv.dev/vulnerability/RUSTSEC-2026-0253) | unknown | lru 0.12.5 (crates.io) | 0.18.2 | Potential use-after-free due to lack of panic safety in \`LruCache::pop()\` |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0173](https://osv.dev/vulnerability/RUSTSEC-2026-0173) | unknown | proc-macro-error2 2.0.1 (crates.io) | none listed | proc-macro-error2 is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/listen2-rust@3.0.6
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/listen2-rust/3.0.6.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/listen2-rust/3.0.6