{"url":"https://pypi.sbomify.com/package/numcodecs-wasm/0.2.5","markdown_url":"https://pypi.sbomify.com/package/numcodecs-wasm/0.2.5.md","name":"numcodecs-wasm","version":"0.2.5","purl":"pkg:pypi/numcodecs-wasm@0.2.5","summary":"numcodecs compression for codecs compiled to WebAssembly","author":null,"project_urls":{},"requires_python":">=3.10","license":null,"classifiers":["Programming Language :: Python :: Implementation :: CPython","Programming Language :: Python :: Implementation :: PyPy","Programming Language :: Rust"],"wheels":[{"filename":"numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/c2/db/b43a1bd0738141d1e6c1a22e4c8785c5b1b7f1bf32a81816018053ddd2f4/numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"d98df0ec-3157-5847-905a-91c5559f6a1b","path":"numcodecs_wasm-0.2.5.dist-info/sboms/numcodecs-wasm.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/d98df0ec-3157-5847-905a-91c5559f6a1b/download","vulnerability_count":40,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"juntyr/numcodecs-rs","workflow":"publish-numcodecs-wasm.yml","environment":"publish","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.10":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/juntyr/numcodecs-rs","1.3.6.1.4.1.57264.1.13":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.14":"refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.15":"830859479","1.3.6.1.4.1.57264.1.16":"https://github.com/juntyr","1.3.6.1.4.1.57264.1.17":"50025784","1.3.6.1.4.1.57264.1.18":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.19":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.20":"workflow_dispatch","1.3.6.1.4.1.57264.1.21":"https://github.com/juntyr/numcodecs-rs/actions/runs/28654838322/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/9d/d7/ebde4b5ea5c496e3f0dd880dc595c1127dd46bc79d200bd472c8bbda6727/numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"1f6e7ea4-834f-566a-b569-3b63ee6a10ad","path":"numcodecs_wasm-0.2.5.dist-info/sboms/numcodecs-wasm.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/1f6e7ea4-834f-566a-b569-3b63ee6a10ad/download","vulnerability_count":40,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"juntyr/numcodecs-rs","workflow":"publish-numcodecs-wasm.yml","environment":"publish","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.10":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/juntyr/numcodecs-rs","1.3.6.1.4.1.57264.1.13":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.14":"refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.15":"830859479","1.3.6.1.4.1.57264.1.16":"https://github.com/juntyr","1.3.6.1.4.1.57264.1.17":"50025784","1.3.6.1.4.1.57264.1.18":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.19":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.20":"workflow_dispatch","1.3.6.1.4.1.57264.1.21":"https://github.com/juntyr/numcodecs-rs/actions/runs/28654838322/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","url":"https://files.pythonhosted.org/packages/20/89/9c242093c349859586f2456ab0faf2fd5bd706be34dd0e8b8e3052f0eeed/numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","sboms":[{"artifact_uuid":"a0637c76-7426-52a6-ad1a-f8e7dd6889e4","path":"numcodecs_wasm-0.2.5.dist-info/sboms/numcodecs-wasm.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/a0637c76-7426-52a6-ad1a-f8e7dd6889e4/download","vulnerability_count":40,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"juntyr/numcodecs-rs","workflow":"publish-numcodecs-wasm.yml","environment":"publish","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.10":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/juntyr/numcodecs-rs","1.3.6.1.4.1.57264.1.13":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.14":"refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.15":"830859479","1.3.6.1.4.1.57264.1.16":"https://github.com/juntyr","1.3.6.1.4.1.57264.1.17":"50025784","1.3.6.1.4.1.57264.1.18":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.19":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.20":"workflow_dispatch","1.3.6.1.4.1.57264.1.21":"https://github.com/juntyr/numcodecs-rs/actions/runs/28654838322/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"numcodecs_wasm-0.2.5-cp310-abi3-pyemscripten_2026_0_wasm32.whl","url":"https://files.pythonhosted.org/packages/c1/c9/2694e94155d04510dbe58470c1c76a47aa0c48bbe3c71e6ad9ff02822f90/numcodecs_wasm-0.2.5-cp310-abi3-pyemscripten_2026_0_wasm32.whl","sboms":[{"artifact_uuid":"95909980-2c96-5852-b9e9-eecb6b28cf22","path":"numcodecs_wasm-0.2.5.dist-info/sboms/numcodecs-wasm.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/95909980-2c96-5852-b9e9-eecb6b28cf22/download","vulnerability_count":4,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"juntyr/numcodecs-rs","workflow":"publish-numcodecs-wasm.yml","environment":"publish","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.10":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/juntyr/numcodecs-rs","1.3.6.1.4.1.57264.1.13":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.14":"refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.15":"830859479","1.3.6.1.4.1.57264.1.16":"https://github.com/juntyr","1.3.6.1.4.1.57264.1.17":"50025784","1.3.6.1.4.1.57264.1.18":"https://github.com/juntyr/numcodecs-rs/.github/workflows/publish-numcodecs-wasm.yml@refs/heads/wasm-guest-registry","1.3.6.1.4.1.57264.1.19":"4e66867a75b089ac71047aefc24b691fb3771099","1.3.6.1.4.1.57264.1.20":"workflow_dispatch","1.3.6.1.4.1.57264.1.21":"https://github.com/juntyr/numcodecs-rs/actions/runs/28654838322/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}}],"formats":["CycloneDX"],"sbom_count":4,"has_attestation":true,"vulnerabilities":[{"id":"CVE-2026-115889","aliases":["GHSA-897f-g5gm-fmxm","RUSTSEC-2026-0380"],"summary":"Bit-packing in Cranelift compiler causes silent overflow and miscompilation","severity":"critical","score":9.9,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["43.0.0"],"url":"https://insights.sbomify.com/CVE-2026-115889/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-115893","aliases":["GHSA-mghf-wjfp-p5xm","RUSTSEC-2026-0379"],"summary":"Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","severity":"critical","score":9.9,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["48.0.7"],"url":"https://insights.sbomify.com/CVE-2026-115893/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34987","aliases":["GHSA-xx5w-cvp6-jv83","RUSTSEC-2026-0095"],"summary":"Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access","severity":"critical","score":9.2,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34987/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34971","aliases":["GHSA-jhxm-h53p-jm7w","RUSTSEC-2026-0096"],"summary":"Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift","severity":"critical","score":9.0,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34971/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-115392","aliases":["GHSA-vqjp-4c8c-hfgg","RUSTSEC-2026-0269"],"summary":"Filesystem sandbox escape when paths or symlinks contain trailing slashes","severity":"high","score":8.8,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["46.0.3"],"url":"https://insights.sbomify.com/CVE-2026-115392/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.26.0","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.26.0","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-pyemscripten_2026_0_wasm32.whl"]},{"id":"CVE-2026-34941","aliases":["GHSA-hx6p-xpx3-jvvv","RUSTSEC-2026-0093"],"summary":"Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding","severity":"high","score":8.1,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34941/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34943","aliases":["GHSA-m758-wjhj-p3jq","RUSTSEC-2026-0085"],"summary":"Panic when lifting `flags` component value","severity":"high","score":7.5,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34943/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34946","aliases":["GHSA-q49f-xg75-m9xw","RUSTSEC-2026-0089"],"summary":"Host panic when Winch compiler executes `table.fill`","severity":"high","score":7.5,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34946/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-27204","aliases":["GHSA-852m-cvvp-9p4w","RUSTSEC-2026-0020"],"summary":"Guest-controlled resource exhaustion in WASI implementations","severity":"medium","score":6.9,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["40.0.4"],"url":"https://insights.sbomify.com/CVE-2026-27204/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-27572","aliases":["GHSA-243v-98vx-264h","RUSTSEC-2026-0021"],"summary":"Panic adding excessive fields to a `wasi:http/types.fields` instance","severity":"medium","score":6.9,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["40.0.4"],"url":"https://insights.sbomify.com/CVE-2026-27572/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34942","aliases":["GHSA-jxhv-7h78-9775","RUSTSEC-2026-0092"],"summary":"Panic when transcoding misaligned component model UTF-16 strings","severity":"medium","score":6.5,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34942/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34945","aliases":["GHSA-m9w2-8782-2946","RUSTSEC-2026-0086"],"summary":"Host data leakage with 64-bit tables and Winch","severity":"medium","score":6.5,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34945/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.26.0","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.26.0","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-pyemscripten_2026_0_wasm32.whl"]},{"id":"CVE-2026-119134","aliases":["GHSA-q554-3cjc-rx7p","RUSTSEC-2026-0363"],"summary":"Component-model handle tables are capped only per instance and charged to no limit","severity":"medium","score":6.2,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["48.0.6"],"url":"https://insights.sbomify.com/CVE-2026-119134/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-35186","aliases":["GHSA-f984-pcp8-v2p7","RUSTSEC-2026-0094"],"summary":"Improperly masked return value from `table.grow` with Winch compiler backend","severity":"medium","score":6.1,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-35186/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-35195","aliases":["GHSA-394w-hwhg-8vgm","RUSTSEC-2026-0091"],"summary":"Out-of-bounds write or crash when transcoding component model strings","severity":"medium","score":6.1,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-35195/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-44216","aliases":["GHSA-p8xm-42r7-89xg","RUSTSEC-2026-0114"],"summary":"Panic when allocating a table exceeding the size of the host's address space","severity":"medium","score":5.9,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["43.0.2"],"url":"https://insights.sbomify.com/CVE-2026-44216/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34944","aliases":["GHSA-qqfj-4vcm-26hv","RUSTSEC-2026-0087"],"summary":"Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64","severity":"medium","score":5.7,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34944/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-24116","aliases":["GHSA-vc8c-j3xm-xj73","RUSTSEC-2026-0006"],"summary":"Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64","severity":"medium","score":4.1,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["40.0.3"],"url":"https://insights.sbomify.com/CVE-2026-24116/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-115393","aliases":["GHSA-hgjw-h833-99q9","RUSTSEC-2026-0222"],"summary":"Stores can mix up type indices between engines","severity":"low","score":3.8,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["46.0.2"],"url":"https://insights.sbomify.com/CVE-2026-115393/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-34988","aliases":["GHSA-6wgr-89rj-399p","RUSTSEC-2026-0088"],"summary":"Data leakage between pooling allocator instances","severity":"low","score":2.3,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["42.0.2"],"url":"https://insights.sbomify.com/CVE-2026-34988/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-115389","aliases":["GHSA-jqpg-j7w6-42pr","RUSTSEC-2026-0316"],"summary":"Dynamic record lifting can allocate beyond the hostcall fuel limit","severity":"low","score":1.0,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["48.0.3"],"url":"https://insights.sbomify.com/CVE-2026-115389/","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-pyemscripten_2026_0_wasm32.whl"]},{"id":"RUSTSEC-2025-0057","aliases":[],"summary":"fxhash - no longer maintained","severity":"unknown","score":null,"package":"fxhash","version":"0.2.1","ecosystem":"crates.io","purl":"pkg:cargo/fxhash@0.2.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0057","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-pyemscripten_2026_0_wasm32.whl"]},{"id":"RUSTSEC-2026-0424","aliases":["GHSA-6fr9-xmw9-5352"],"summary":"Unchecked memory usage in transferring borrowed resources between components","severity":"unknown","score":null,"package":"wasmtime","version":"37.0.3","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@37.0.3","fixed":["48.0.8"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0424","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0391","aliases":[],"summary":"Data from an abandoned stream leaks into the next stream on a reused context","severity":"unknown","score":null,"package":"zstd","version":"0.13.3","ecosystem":"crates.io","purl":"pkg:cargo/zstd@0.13.3","fixed":["0.13.4"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0391","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0395","aliases":[],"summary":"Use-after-free with `CParameter::StableInBuffer`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0395","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0396","aliases":[],"summary":"`Seekable` reads a NULL or out-of-bounds seek table","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0396","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0397","aliases":[],"summary":"`OutBuffer::around_pos` exposes uninitialized memory","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0397","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0398","aliases":[],"summary":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0398","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0399","aliases":[],"summary":"Use-after-free through `init_using_cdict` and `init_using_ddict`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0400","aliases":[],"summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0401","aliases":[],"summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0401","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0402","aliases":[],"summary":"Heap buffer overflow in `CCtx::try_clone` on a multithreaded context","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0402","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0403","aliases":[],"summary":"Uninitialized memory exposed when streaming decompression of a legacy frame fails","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0403","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0404","aliases":[],"summary":"Double free in `DCtx::try_clone`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0404","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0405","aliases":[],"summary":"Out-of-bounds read with an out-of-range `InBuffer::pos`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0405","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0406","aliases":[],"summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0410","aliases":[],"summary":"WebAssembly allocator shim corrupts memory on allocation failure","severity":"unknown","score":null,"package":"zstd-sys","version":"2.0.16+zstd.1.5.7","ecosystem":"crates.io","purl":"pkg:cargo/zstd-sys@2.0.16%2Bzstd.1.5.7","fixed":["2.1.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0410","wheels":["numcodecs_wasm-0.2.5-cp310-abi3-macosx_10_12_x86_64.whl","numcodecs_wasm-0.2.5-cp310-abi3-macosx_11_0_arm64.whl","numcodecs_wasm-0.2.5-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]}],"vulnerability_scan":{"scanned_sboms":4,"total_sboms":4,"scanned_at":"2026-11-09","scanner":"osv-scanner 2.7.0","severity_counts":{"critical":4,"high":5,"medium":11,"low":3,"unknown":17}}}