# SBOM for maturin 1.16.0 > Build and publish crates with pyo3, cffi and uniffi bindings as well as rust binaries as python packages The Python package maturin 1.16.0 ships 13 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation. - Package URL (PURL): `pkg:pypi/maturin@1.16.0` - PyPI: https://pypi.org/project/maturin/1.16.0/ - Requires Python: \>=3.7 - Changelog: - Documentation: - Homepage: - Issues: - Source Code: ## SBOMs ### maturin-1.16.0-py3-none-linux\_armv6l.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/4db0ce70-5c0f-51e6-bc54-df4a818d66d0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/d47a17c8-fbb6-578a-9dd2-2143d7546de1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-macosx\_10\_12\_x86\_64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/12bba1e7-8de7-51d1-b683-83aa2744a867/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux2010\_x86\_64.manylinux\_2\_12\_x86\_64.musllinux\_1\_1\_x86\_64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/753f640a-d79d-5298-bb4e-21af3137cd7a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux\_2\_12\_i686.manylinux2010\_i686.musllinux\_1\_1\_i686.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/3861665a-afbe-57f6-8ad6-5773eab26b2b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.musllinux\_1\_1\_aarch64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/c27fc92b-c7d4-5b3e-bb62-43cf44967230/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.musllinux\_1\_1\_armv7l.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/f1f2d303-3f9c-5327-b8ce-c2b10a52852a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.musllinux\_1\_1\_ppc64le.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/5c6d877e-b9ff-50e2-ba58-579710cd3fdf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/41ef5a11-3fae-5ce6-9a11-e95ef3ca2fbc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-manylinux\_2\_31\_riscv64.musllinux\_1\_1\_riscv64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/cfb4a640-2574-584a-a913-31927a4013e2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-win32.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/5bce735d-a437-5b8d-96f2-5d7e0f7e075e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-win\_amd64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/d0f59758-c209-5d09-8855-11d4e538c45e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ### maturin-1.16.0-py3-none-win\_arm64.whl PEP 740 attestation verified (GitHub, PyO3/maturin, workflow release.yml). - [maturin-1.16.0.dist-info/sboms/maturin.cyclonedx.json](https://pypi.sbomify.com/artifact/3a4a758e-7777-55dc-84f7-64cbf679fbac/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 11 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/) | critical (10.0) | zip 8.6.0 (crates.io) | 9.0.5 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | | [RUSTSEC-2026-0369](https://osv.dev/vulnerability/RUSTSEC-2026-0369) | critical (9.1) | zip 8.6.0 (crates.io) | 9.0.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target | | [RUSTSEC-2026-0344](https://osv.dev/vulnerability/RUSTSEC-2026-0344) | high (7.5) | ruzstd 0.8.2 (crates.io) | 0.9.1 | Decompression bomb in \`ruzstd\`: a tiny input can exhaust memory (OOM) | | [CVE-2026-115907](https://insights.sbomify.com/CVE-2026-115907/) | high (7.5) | zip 8.6.0 (crates.io) | 9.0.0 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size | | [CVE-2026-115909](https://insights.sbomify.com/CVE-2026-115909/) | high (7.5) | zip 8.6.0 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` aborts the process on a symlink entry with a large declared size | | [CVE-2026-115908](https://insights.sbomify.com/CVE-2026-115908/) | high (7.4) | zip 8.6.0 (crates.io) | 9.0.0 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. | | [RUSTSEC-2026-0367](https://osv.dev/vulnerability/RUSTSEC-2026-0367) | high (7.3) | zip 8.6.0 (crates.io) | 9.0.0 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation | | [CVE-2026-115906](https://insights.sbomify.com/CVE-2026-115906/) | medium (6.5) | zip 8.6.0 (crates.io) | 9.0.0 | zip: AES Entry HMAC Authentication Bypass on Premature EOF | | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0368](https://osv.dev/vulnerability/RUSTSEC-2026-0368) | unknown | zip 8.6.0 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` creates symbolic links whose attacker-controlled targets are outside the destination directory | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/maturin@1.16.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/maturin/1.16.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/maturin/1.16.0