Skip to content

SBOM for maturin 1.16.0

Build and publish crates with pyo3, cffi and uniffi bindings as well as rust binaries as python packages

CycloneDX PEP 740 attested 11 known vulnerabilities

Requires Python: >=3.7
PyPI: maturin 1.16.0
Changelog: https://maturin.rs/changelog.html
Documentation: https://maturin.rs
Homepage: https://github.com/pyo3/maturin
Issues: https://github.com/PyO3/maturin/issues
Source Code: https://github.com/PyO3/maturin

Available SBOMs

Read from .dist-info/sboms/ in each wheel.

maturin-1.16.0-py3-none-linux_armv6l.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-macosx_10_12_universal2.macosx_10_12_x86_64.macosx_11_0_arm64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-macosx_10_12_x86_64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux2010_x86_64.manylinux_2_12_x86_64.musllinux_1_1_x86_64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux_2_12_i686.manylinux2010_i686.musllinux_1_1_i686.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_1_armv7l.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.musllinux_1_1_ppc64le.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-manylinux_2_31_riscv64.musllinux_1_1_riscv64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-win32.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-win_amd64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

maturin-1.16.0-py3-none-win_arm64.whl

Attested

Publisher: GitHub Source: PyO3/maturin Workflow: release.yml Environment: pypi

maturin.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 11 known vulnerabilities

Known vulnerabilities

Components listed in these SBOMs, matched against the OSV database as of 2026-11-09.

Vulnerability	Severity	Component	Fixed in
CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE	Critical 10.0	zip 8.6.0 crates.io	9.0.5
RUSTSEC-2026-0369 ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target	Critical 9.1	zip 8.6.0 crates.io	9.0.0
RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)	High 7.5	ruzstd 0.8.2 crates.io	0.9.1
CVE-2026-115907 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size	High 7.5	zip 8.6.0 crates.io	9.0.0
CVE-2026-115909 zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size	High 7.5	zip 8.6.0 crates.io	9.0.0
CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.	High 7.4	zip 8.6.0 crates.io	9.0.0
RUSTSEC-2026-0367 Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation	High 7.3	zip 8.6.0 crates.io	9.0.0
CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF	Medium 6.5	zip 8.6.0 crates.io	9.0.0
GHSA-qwgh-2vcv-g2f7 block_buffer: panic corrupts inline buffer position	Medium 6.3	block-buffer 0.12.0 crates.io	—
RUSTSEC-2024-0436 paste - no longer maintained	Unknown	paste 1.0.15 crates.io	—
RUSTSEC-2026-0368 zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory	Unknown	zip 8.6.0 crates.io	9.0.0

Access via TEA

Use the Transparency Exchange API to fetch this SBOM programmatically:

pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]