# SBOM for py-spy 0.4.3

The Python package py-spy 0.4.3 ships 8 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/py-spy@0.4.3`
- PyPI: https://pypi.org/project/py-spy/0.4.3/
- Homepage: <https://github.com/benfred/py-spy>

## SBOMs

### py\_spy-0.4.3-py2.py3-none-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/c80f273c-5bf9-5854-89bd-6ba2990f44c4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-macosx\_11\_0\_arm64.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/68046a54-79f1-54db-8617-8e2d42143d84/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-manylinux1\_i686.manylinux\_2\_5\_i686.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/715e6b3c-6dc7-5e4d-86da-c09a935cc234/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-manylinux1\_x86\_64.manylinux\_2\_5\_x86\_64.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/b5fb012d-dd11-5c69-b2e7-4c1d436530a2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/bda5f198-381b-5b45-bbbf-c2b399549f08/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-manylinux2014\_armv7l.manylinux\_2\_17\_armv7l.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/c69e2c75-aa76-519e-b62b-c60c76c2ab18/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-win\_amd64.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/6da76fa4-c042-5ca4-aa1e-ba0bb05979c9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### py\_spy-0.4.3-py2.py3-none-win\_arm64.whl

- [py\_spy-0.4.3.dist-info/sboms/py-spy.cyclonedx.json](https://pypi.sbomify.com/artifact/b668f3b9-3e47-54de-b560-95e307eef04b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.39.2 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.39.2 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
| [RUSTSEC-2026-0253](https://osv.dev/vulnerability/RUSTSEC-2026-0253) | unknown | lru 0.17.0 (crates.io) | 0.18.2 | Potential use-after-free due to lack of panic safety in \`LruCache::pop()\` |
| [RUSTSEC-2020-0168](https://osv.dev/vulnerability/RUSTSEC-2020-0168) | unknown | mach 0.3.2 (crates.io) | none listed | mach is unmaintained |
| [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.10 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/py-spy@0.4.3
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/py-spy/0.4.3.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/py-spy/0.4.3