# SBOM for pybinwalk 0.0.3

> Python bindings for Binwalk v3

The Python package pybinwalk 0.0.3 ships 4 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/pybinwalk@0.0.3`
- PyPI: https://pypi.org/project/pybinwalk/0.0.3/
- Author: Kevin Muñoz
- License: MIT
- Requires Python: \>=3.8
- Documentation: <https://github.com/kevinmuoz/pybinwalk#readme>
- Homepage: <https://github.com/kevinmuoz/pybinwalk>
- Issues: <https://github.com/kevinmuoz/pybinwalk/issues>
- Repository: <https://github.com/kevinmuoz/pybinwalk>

## SBOMs

### pybinwalk-0.0.3-cp38-abi3-macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.macosx\_10\_12\_universal2.whl

PEP 740 attestation verified (GitHub, kevinmuoz/pybinwalk, workflow ci.yml).

- [pybinwalk-0.0.3.dist-info/sboms/pybinwalk.cyclonedx.json](https://pypi.sbomify.com/artifact/0a23f3fa-680d-5a79-b50c-286f1127d2ed/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 6 known vulnerabilities

### pybinwalk-0.0.3-cp38-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, kevinmuoz/pybinwalk, workflow ci.yml).

- [pybinwalk-0.0.3.dist-info/sboms/pybinwalk.cyclonedx.json](https://pypi.sbomify.com/artifact/9af62150-4863-5662-ae05-6c00a4d07401/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

### pybinwalk-0.0.3-cp38-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, kevinmuoz/pybinwalk, workflow ci.yml).

- [pybinwalk-0.0.3.dist-info/sboms/pybinwalk.cyclonedx.json](https://pypi.sbomify.com/artifact/fe618b43-c48e-5aea-89d0-370d21f72cf4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

### pybinwalk-0.0.3-pp311-pypy311\_pp73-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

PEP 740 attestation verified (GitHub, kevinmuoz/pybinwalk, workflow ci.yml).

- [pybinwalk-0.0.3.dist-info/sboms/pybinwalk.cyclonedx.json](https://pypi.sbomify.com/artifact/f13ac72f-6f9e-55af-92bd-16a572b1834b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.0 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0013](https://osv.dev/vulnerability/RUSTSEC-2026-0013) | high (7.2) | pyo3 0.28.0 (crates.io) | 0.28.2 | Type confusion when accessing data from sublasses of subclasses of native types with \`abi3\` feature targeting Python 3.12 and up |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.0 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [GHSA-6g2r-675j-hx59](https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59) | low (2.3) | xxhash-rust 0.8.15 (crates.io) | 0.8.16 | xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.101 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.9.2 (crates.io) | 0.9.3 | Rand is unsound with a custom logger using \`rand::rng()\` |
| [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.20.0 (crates.io) | none listed | \`ttf-parser\` is unmaintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pybinwalk@0.0.3
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/pybinwalk/0.0.3.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pybinwalk/0.0.3