# SBOM for ormdantic 2.0.1 > Rust-backed async ORM for Python applications that already use Pydantic models as their data boundary. The Python package ormdantic 2.0.1 ships 15 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/ormdantic@2.0.1` - PyPI: https://pypi.org/project/ormdantic/2.0.1/ - Requires Python: \>=3.10 - Documentation: - Funding: - Homepage: ## SBOMs ### ormdantic-2.0.1-cp310-cp310-macosx\_11\_0\_arm64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/8d1adb44-d8ab-599c-ae59-72299cbbbe89/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp310-cp310-manylinux\_2\_38\_x86\_64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/60be06ef-c323-551f-994e-cf83f19d4a83/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp310-cp310-win\_amd64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/c9be2196-1c18-5ebf-a8f8-7d4bc88048ad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp311-cp311-macosx\_11\_0\_arm64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/19bd300b-bd27-5a2e-9699-92f2fce49274/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp311-cp311-manylinux\_2\_38\_x86\_64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/6a5d41d5-4cbe-55b2-8ce9-30ef02563ddf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp311-cp311-win\_amd64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/19547283-d143-55b7-9a1b-3749de68f3cf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp312-cp312-macosx\_11\_0\_arm64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/2d5379fe-51e4-51f2-8ad9-5d600d5fca8d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp312-cp312-manylinux\_2\_38\_x86\_64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/5bb88b90-4626-5a11-9a38-20d48befc990/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp312-cp312-win\_amd64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/e8846cd8-e682-5550-80e4-c07fda60ff43/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp313-cp313-macosx\_11\_0\_arm64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/33b6317c-c599-5a1a-a2e0-60edc50e3bb5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp313-cp313-manylinux\_2\_38\_x86\_64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/d08bfee1-0a9d-549e-b06b-f8c2f636578f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp313-cp313-win\_amd64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/9eb0b233-3e50-52ae-b9db-741286f2cc1c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp314-cp314-macosx\_11\_0\_arm64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/838aa104-03a8-5578-bdc2-c2b4a116bdb2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp314-cp314-manylinux\_2\_38\_x86\_64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/c34e84a3-14a0-5cce-b574-733e00c42f1a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ### ormdantic-2.0.1-cp314-cp314-win\_amd64.whl - [ormdantic-2.0.1.dist-info/sboms/ormdantic-py.cyclonedx.json](https://pypi.sbomify.com/artifact/bc8e6bba-1077-55f1-8ab1-caea398135e0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 25 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0179](https://osv.dev/vulnerability/RUSTSEC-2026-0179) | high (8.7) | postgres-protocol 0.6.11 (crates.io) | 0.6.12 | Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service | | [CVE-2026-93599](https://insights.sbomify.com/CVE-2026-93599/) | high (7.5) | rustls-webpki 0.101.7 (crates.io) | 0.103.13 | Reachable panic in certificate revocation list parsing | | [RUSTSEC-2026-0180](https://osv.dev/vulnerability/RUSTSEC-2026-0180) | medium (6.9) | postgres-protocol 0.6.11 (crates.io) | 0.6.12 | Panic decoding a malformed \`hstore\` value allows denial of service | | [RUSTSEC-2026-0178](https://osv.dev/vulnerability/RUSTSEC-2026-0178) | medium (6.9) | tokio-postgres 0.7.17 (crates.io) | 0.7.18 | Panic on a \`DataRow\` with fewer fields than columns allows denial of service | | [CVE-2026-119375](https://insights.sbomify.com/CVE-2026-119375/) | medium (6.8) | libsqlite3-sys 0.30.1 (crates.io) | 0.39.0 | \`libsqlite3-sys\` via C SQLite CVE-2026-119375 | | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [CVE-2026-123613](https://insights.sbomify.com/CVE-2026-123613/) | medium (5.3) | rustls 0.23.40 (crates.io) | 0.23.45 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.21.12 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.40 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.21.12 (crates.io) | 0.23.46 | Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.40 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.21.12 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.40 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [CVE-2026-93600](https://insights.sbomify.com/CVE-2026-93600/) | low (2.2) | rustls-webpki 0.101.7 (crates.io) | 0.103.12 | Name constraints for URI names were incorrectly accepted | | [CVE-2026-93601](https://insights.sbomify.com/CVE-2026-93601/) | low (2.2) | rustls-webpki 0.101.7 (crates.io) | 0.103.12 | Name constraints were accepted for certificates asserting a wildcard name | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2026-0385](https://osv.dev/vulnerability/RUSTSEC-2026-0385) | unknown | ctutils 0.4.2 (crates.io) | 0.4.4 | Non-constant-time mask generation and \`u128\` comparisons | | [RUSTSEC-2026-0418](https://osv.dev/vulnerability/RUSTSEC-2026-0418) | unknown | libz-sys 1.1.29 (crates.io) | 1.1.31 | libz-sys build script leaks environment variables in the build directory | | [RUSTSEC-2026-0253](https://osv.dev/vulnerability/RUSTSEC-2026-0253) | unknown | lru 0.16.4 (crates.io) | 0.18.2 | Potential use-after-free due to lack of panic safety in \`LruCache::pop()\` | | [RUSTSEC-2025-0134](https://osv.dev/vulnerability/RUSTSEC-2025-0134) | unknown | rustls-pemfile 1.0.4 (crates.io) | none listed | rustls-pemfile is unmaintained | | [RUSTSEC-2025-0134](https://osv.dev/vulnerability/RUSTSEC-2025-0134) | unknown | rustls-pemfile 2.2.0 (crates.io) | none listed | rustls-pemfile is unmaintained | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.101.7 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.13 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.52.3 (crates.io) | 1.53.3 | \`AsyncFd::new\` and related constructors violate I/O safety | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 1.0.7 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/ormdantic@2.0.1 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/ormdantic/2.0.1.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/ormdantic/2.0.1