# SBOM for pepmatch 1.17.2

> Search tool for peptides and epitopes within a proteome, while considering potential residue substitutions.

The Python package pepmatch 1.17.2 ships 12 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/pepmatch@1.17.2`
- PyPI: https://pypi.org/project/pepmatch/1.17.2/
- Homepage: <https://github.com/IEDB/PEPMatch>

## SBOMs

### pepmatch-1.17.2-cp310-cp310-macosx\_11\_0\_arm64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/8b858334-041f-53d3-9990-3d47232b5032/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/53a2554e-356c-5ee1-90b6-42e3881bf98e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp310-cp310-win\_amd64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/7f793ae0-246d-5f98-b28e-117b95d1650b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp311-cp311-macosx\_11\_0\_arm64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/d74b0694-eff0-5a14-bcae-0935fd40cc82/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/af32ebe1-a270-524d-a730-a9b61a6108a9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp311-cp311-win\_amd64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/77d00448-847a-5e8c-9e4f-bc66cce0d925/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp312-cp312-macosx\_11\_0\_arm64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/b947b2cd-bfbc-510f-8e87-732749f493d5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/b5c00417-e5f8-55b2-9ed8-85b5330783c2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp312-cp312-win\_amd64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/1b7a7678-2b62-51f3-8493-3b09dfffdcde/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp313-cp313-macosx\_11\_0\_arm64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/c476edb1-c041-5410-b271-eec33902e5d6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/38af21a5-3fc2-5e46-83c7-9c5db0b514ae/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### pepmatch-1.17.2-cp313-cp313-win\_amd64.whl

- [pepmatch-1.17.2.dist-info/sboms/pepmatch\_rs\_engine.cyclonedx.json](https://pypi.sbomify.com/artifact/a77c3ba2-8165-5571-905d-a29e02252923/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-09.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.24.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.24.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.10 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pepmatch@1.17.2
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/pepmatch/1.17.2.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pepmatch/1.17.2