# SBOM for lynsedb 0.9.0 > A Python-first, Rust-powered vector database for AI apps, from embedded local storage to HTTP service and lightweight sharded clusters. The Python package lynsedb 0.9.0 ships 30 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/lynsedb@0.9.0` - PyPI: https://pypi.org/project/lynsedb/0.9.0/ - License: Apache-2.0 - Requires Python: \>=3.9 - homepage: ## SBOMs ### lynsedb-0.9.0-cp310-cp310-macosx\_10\_13\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/8e41034c-f85c-5311-9911-4d6977e0ad73/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp310-cp310-macosx\_11\_0\_arm64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/922db494-bb06-5b45-a4e5-3d923192a849/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/4737d2c2-e299-558c-a4df-29aecfd98f4b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp310-cp310-manylinux\_2\_28\_aarch64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/77edff2b-7321-5d9b-b3f4-14aaa17ac3e4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp310-cp310-win\_amd64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/8348d40b-8515-5660-9dbb-124856ee032f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp311-cp311-macosx\_10\_13\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/70a884c6-a434-589c-ab8e-c0b62c60e069/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp311-cp311-macosx\_11\_0\_arm64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/a18d025e-9896-5fe4-a387-75fb1bca4e15/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/9fd5c7ce-55b5-5ffb-8e59-76b09f1996ab/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp311-cp311-manylinux\_2\_28\_aarch64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/ec818c4c-eb89-5353-b2d2-b9e73c263680/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp311-cp311-win\_amd64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/936e71d4-4897-5719-a29f-fc24346293f0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp312-cp312-macosx\_10\_13\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/71a5b055-4987-5447-99be-1ea3941a1127/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp312-cp312-macosx\_11\_0\_arm64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/3fdab700-e6be-57c9-8039-e41b5e87b760/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/f66429c3-bea3-517e-aa4b-5e325baa7371/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp312-cp312-manylinux\_2\_28\_aarch64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/f187a8a0-c4bd-5daa-8d1d-b8782d77e451/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp312-cp312-win\_amd64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/cd10ca61-e806-5bd3-85a4-11429d1f270e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp313-cp313-macosx\_10\_13\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/4fd447f7-af05-56db-a19e-f32d1341b95e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp313-cp313-macosx\_11\_0\_arm64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/2cead67d-0856-5bc5-85cd-586a49d62ec1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/e05da623-5a71-5ede-aa30-fb28363c2df0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp313-cp313-manylinux\_2\_28\_aarch64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/ef9d109b-648b-5836-874a-c9cb1c966a7a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp313-cp313-win\_amd64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/c41e7aeb-9c9e-5552-8b2d-51ef9d02208f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp314-cp314-macosx\_10\_13\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/72345e91-310d-5d0f-9d6b-a6d93184f05c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp314-cp314-macosx\_11\_0\_arm64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/37056ed4-b23c-5ccc-9b6c-1bd998f46106/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/80fa22e7-6bc2-597f-9ece-278d53a0d9ea/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp314-cp314-manylinux\_2\_28\_aarch64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/09b42dc4-4617-582c-ae5e-2bf29e8cfe94/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp314-cp314-win\_amd64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/b0ff51f3-57e8-5fda-8655-7146d92c17cd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp39-cp39-macosx\_10\_13\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/b6cf943e-de0e-573b-a183-22f460a832c0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp39-cp39-macosx\_11\_0\_arm64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/720e73b5-5eb2-594e-8781-2044fbb99310/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp39-cp39-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/eae71c75-2928-5128-b3f7-a3f67c96eb64/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp39-cp39-manylinux\_2\_28\_aarch64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/cb3085a5-9cf9-52f2-8ed3-7431bea0454a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ### lynsedb-0.9.0-cp39-cp39-win\_amd64.whl - [lynsedb-0.9.0.dist-info/sboms/lynse.cyclonedx.json](https://pypi.sbomify.com/artifact/bb69b271-f0da-5d57-9ecb-3585a5a41a38/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 39 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.26.0 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [CVE-2026-73051](https://insights.sbomify.com/CVE-2026-73051/) | medium (6.3) | actix-http 3.12.0 (crates.io) | 3.12.1 | actix-http has HTTP/1.1 CL.TE Request Smuggling | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.26.0 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [CVE-2026-123613](https://insights.sbomify.com/CVE-2026-123613/) | medium (5.3) | rustls 0.23.40 (crates.io) | 0.23.45 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.40 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.40 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.40 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [RUSTSEC-2024-0379](https://osv.dev/vulnerability/RUSTSEC-2024-0379) | low (2.7) | fast-float 0.2.0 (crates.io) | none listed | Multiple soundness issues | | [RUSTSEC-2026-0446](https://osv.dev/vulnerability/RUSTSEC-2026-0446) | unknown | actix-http 3.12.0 (crates.io) | 3.20.2 | Request smuggling through malformed chunked request trailers | | [RUSTSEC-2026-0448](https://osv.dev/vulnerability/RUSTSEC-2026-0448) | unknown | actix-http 3.12.0 (crates.io) | 3.20.1 | Unbounded decompression can exhaust memory and CPU resources | | [RUSTSEC-2026-0455](https://osv.dev/vulnerability/RUSTSEC-2026-0455) | unknown | actix-http 3.12.0 (crates.io) | 3.20.3 | Large-window Brotli bodies bypass decompression memory limits | | [RUSTSEC-2026-0447](https://osv.dev/vulnerability/RUSTSEC-2026-0447) | unknown | actix-web 4.13.0 (crates.io) | 4.18.2 | Compressed request bodies can exhaust memory before extractor limits apply | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [CVE-2026-111959](https://insights.sbomify.com/CVE-2026-111959/) | unknown | arrow-data 59.1.0 (crates.io) | 59.3.2 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid | | [RUSTSEC-2025-0003](https://osv.dev/vulnerability/RUSTSEC-2025-0003) | unknown | fast-float 0.2.0 (crates.io) | none listed | Segmentation fault due to lack of bound check | | [RUSTSEC-2026-0258](https://osv.dev/vulnerability/RUSTSEC-2026-0258) | unknown | h2 0.3.27 (crates.io) | 0.4.16 | h2 unbounded empty DATA frames | | [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.10 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.9.2 (crates.io) | 0.9.3 | Rand is unsound with a custom logger using \`rand::rng()\` | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.13 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.50.0 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 1.0.8 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates | | [RUSTSEC-2026-0391](https://osv.dev/vulnerability/RUSTSEC-2026-0391) | unknown | zstd 0.13.3 (crates.io) | 0.13.4 | Data from an abandoned stream leaks into the next stream on a reused context | | [RUSTSEC-2026-0395](https://osv.dev/vulnerability/RUSTSEC-2026-0395) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free with \`CParameter::StableInBuffer\` | | [RUSTSEC-2026-0396](https://osv.dev/vulnerability/RUSTSEC-2026-0396) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | \`Seekable\` reads a NULL or out-of-bounds seek table | | [RUSTSEC-2026-0397](https://osv.dev/vulnerability/RUSTSEC-2026-0397) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | \`OutBuffer::around\_pos\` exposes uninitialized memory | | [RUSTSEC-2026-0398](https://osv.dev/vulnerability/RUSTSEC-2026-0398) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | \`Seekable::decompress\` sets a \`Vec\` length beyond its capacity for offsets past the end | | [RUSTSEC-2026-0399](https://osv.dev/vulnerability/RUSTSEC-2026-0399) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free through \`init\_using\_cdict\` and \`init\_using\_ddict\` | | [RUSTSEC-2026-0400](https://osv.dev/vulnerability/RUSTSEC-2026-0400) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free of a dictionary after a one-shot call on a context with an open stream | | [RUSTSEC-2026-0401](https://osv.dev/vulnerability/RUSTSEC-2026-0401) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Out-of-bounds read in \`train\_from\_buffer\` when sample sizes overflow | | [RUSTSEC-2026-0402](https://osv.dev/vulnerability/RUSTSEC-2026-0402) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Heap buffer overflow in \`CCtx::try\_clone\` on a multithreaded context | | [RUSTSEC-2026-0403](https://osv.dev/vulnerability/RUSTSEC-2026-0403) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Uninitialized memory exposed when streaming decompression of a legacy frame fails | | [RUSTSEC-2026-0404](https://osv.dev/vulnerability/RUSTSEC-2026-0404) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Double free in \`DCtx::try\_clone\` | | [RUSTSEC-2026-0405](https://osv.dev/vulnerability/RUSTSEC-2026-0405) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Out-of-bounds read with an out-of-range \`InBuffer::pos\` | | [RUSTSEC-2026-0406](https://osv.dev/vulnerability/RUSTSEC-2026-0406) | unknown | zstd-safe 7.2.4 (crates.io) | 7.4.0 | Use-after-free when changing a multithreaded context with an unfinished frame | | [RUSTSEC-2026-0410](https://osv.dev/vulnerability/RUSTSEC-2026-0410) | unknown | zstd-sys 2.0.16+zstd.1.5.7 (crates.io) | 2.1.2 | WebAssembly allocator shim corrupts memory on allocation failure | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/lynsedb@0.9.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/lynsedb/0.9.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/lynsedb/0.9.0