# SBOM for pyfadetop 0.3.0 The Python package pyfadetop 0.3.0 ships 6 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/pyfadetop@0.3.0` - PyPI: https://pypi.org/project/pyfadetop/0.3.0/ - Author: Feiyang472 - Homepage: - Repository: ## SBOMs ### pyfadetop-0.3.0-py3-none-macosx\_11\_0\_arm64.whl - [pyfadetop-0.3.0.dist-info/sboms/fadetop.cyclonedx.json](https://pypi.sbomify.com/artifact/efa3a942-21fb-5eff-a2a6-0cf99fec7c4f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### pyfadetop-0.3.0-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [pyfadetop-0.3.0.dist-info/sboms/fadetop.cyclonedx.json](https://pypi.sbomify.com/artifact/8cfc6678-4f0d-505b-ab24-78846248633f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### pyfadetop-0.3.0-py3-none-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [pyfadetop-0.3.0.dist-info/sboms/fadetop.cyclonedx.json](https://pypi.sbomify.com/artifact/6a3c7c52-28ed-542f-be24-558a09d2f677/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### pyfadetop-0.3.0-py3-none-manylinux\_2\_5\_i686.manylinux1\_i686.whl - [pyfadetop-0.3.0.dist-info/sboms/fadetop.cyclonedx.json](https://pypi.sbomify.com/artifact/248643d8-d316-55bc-bd0f-bf5a06f2d35c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### pyfadetop-0.3.0-py3-none-manylinux\_2\_5\_x86\_64.manylinux1\_x86\_64.whl - [pyfadetop-0.3.0.dist-info/sboms/fadetop.cyclonedx.json](https://pypi.sbomify.com/artifact/2a6e5644-83c6-55b2-bb1b-c29340d46a56/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 12 known vulnerabilities ### pyfadetop-0.3.0-py3-none-win\_amd64.whl - [pyfadetop-0.3.0.dist-info/sboms/fadetop.cyclonedx.json](https://pypi.sbomify.com/artifact/b55609fd-67cc-5e29-a4a6-5bc02fda11bc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 14 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0344](https://osv.dev/vulnerability/RUSTSEC-2026-0344) | high (7.5) | ruzstd 0.8.3 (crates.io) | 0.9.1 | Decompression bomb in \`ruzstd\`: a tiny input can exhaust memory (OOM) | | [CVE-2026-25727](https://insights.sbomify.com/CVE-2026-25727/) | medium (6.8) | time 0.3.44 (crates.io) | 0.3.47 | Denial of Service via Stack Exhaustion | | [CVE-2025-4574](https://insights.sbomify.com/CVE-2025-4574/) | medium (6.3) | crossbeam-channel 0.5.14 (crates.io) | 0.5.15 | crossbeam-channel: double free on Drop | | [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/) | medium (5.5) | bytes 1.10.1 (crates.io) | 1.11.1 | Integer overflow in \`BytesMut::reserve\` | | [RUSTSEC-2026-0002](https://osv.dev/vulnerability/RUSTSEC-2026-0002) | low (2.7) | lru 0.12.5 (crates.io) | 0.16.3 | \`IterMut\` violates Stacked Borrows by invalidating internal pointer | | [CVE-2025-58160](https://insights.sbomify.com/CVE-2025-58160/) | low (2.3) | tracing-subscriber 0.3.19 (crates.io) | 0.3.20 | Logging user input may result in poisoning logs with ANSI escape sequences | | [RUSTSEC-2025-0056](https://osv.dev/vulnerability/RUSTSEC-2025-0056) | unknown | adler 1.0.2 (crates.io) | none listed | adler crate is unmaintained, use adler2 instead | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2026-0253](https://osv.dev/vulnerability/RUSTSEC-2026-0253) | unknown | lru 0.12.5 (crates.io) | 0.18.2 | Potential use-after-free due to lack of panic safety in \`LruCache::pop()\` | | [RUSTSEC-2026-0253](https://osv.dev/vulnerability/RUSTSEC-2026-0253) | unknown | lru 0.17.0 (crates.io) | 0.18.2 | Potential use-after-free due to lack of panic safety in \`LruCache::pop()\` | | [RUSTSEC-2020-0168](https://osv.dev/vulnerability/RUSTSEC-2020-0168) | unknown | mach 0.3.2 (crates.io) | none listed | mach is unmaintained | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.44.2 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/pyfadetop@0.3.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/pyfadetop/0.3.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/pyfadetop/0.3.0