SBOM for pylance 14.0.2

Requires Python: >=3.10
PyPI: pylance 14.0.2

Available SBOMs

Read from .dist-info/sboms/ in each wheel.

pylance-14.0.2-cp310-abi3-macosx_11_0_arm64.whl

pylance.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 24 known vulnerabilities

Download

pylance-14.0.2-cp310-abi3-win_amd64.whl

pylance.cyclonedx.json

CycloneDX/1.5 application/vnd.cyclonedx+json 25 known vulnerabilities

Download

Known vulnerabilities

Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.

Vulnerability	Severity	Component	Fixed in
RUSTSEC-2026-0176 Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators	High 8.7	pyo3 0.28.3 crates.io	0.29.0
RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled	High 7.5	quinn-proto 0.11.16 crates.io	0.11.18
RUSTSEC-2026-0341 Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed	High 7.5	quinn-proto 0.11.16 crates.io	0.11.17
CVE-2026-43868 Unbounded memory allocation in `thrift` binary protocol `read_bytes`	High 7.5	thrift 0.17.0 crates.io	0.23.0
RUSTSEC-2026-0177 Missing `Sync` bound on `PyCFunction::new_closure` closures	Medium 6.3	pyo3 0.28.3 crates.io	0.29.0
CVE-2023-49092 Marvin Attack: potential key recovery through timing sidechannels	Medium 5.9	rsa 0.9.10 crates.io	0.10.0
CVE-2026-111959 Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads	Unknown	arrow-data 58.4.0 crates.io	58.4.1
RUSTSEC-2026-0253 Potential use-after-free due to lack of panic safety in `LruCache::pop()`	Unknown	lru 0.16.4 crates.io	0.18.2
RUSTSEC-2024-0436 paste - no longer maintained	Unknown	paste 1.0.15 crates.io	—
RUSTSEC-2026-0441 `pin-utils` is unmaintained	Unknown	pin-utils 0.1.0 crates.io	—
RUSTSEC-2026-0338 Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads	Unknown	quinn-proto 0.11.16 crates.io	0.11.18
RUSTSEC-2026-0339 Unbounded growth of pending connection ID retirements in quinn-proto	Unknown	quinn-proto 0.11.16 crates.io	0.11.17
RUSTSEC-2026-0342 Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto	Unknown	quinn-proto 0.11.16 crates.io	0.11.17
CVE-2026-111943 Certificate verification may accept distrusted intermediates	Unknown	rustls-webpki 0.103.15 crates.io	0.103.16
RUSTSEC-2024-0449 unsafe-libyaml is unmaintained	Unknown	unsafe-libyaml 0.2.11 crates.io	—
CVE-2026-111943 Bundled root certificates allow trust in distrusted emSign intermediates	Unknown	webpki-root-certs 1.0.8 crates.io · 1 of 2 wheels	1.0.10
RUSTSEC-2026-0395 Use-after-free with `CParameter::StableInBuffer`	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0397 `OutBuffer::around_pos` exposes uninitialized memory	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0399 Use-after-free through `init_using_cdict` and `init_using_ddict`	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0402 Heap buffer overflow in `CCtx::try_clone` on a multithreaded context	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0403 Uninitialized memory exposed when streaming decompression of a legacy frame fails	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0404 Double free in `DCtx::try_clone`	Unknown	zstd-safe 7.2.1 crates.io	7.4.0
RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame	Unknown	zstd-safe 7.2.1 crates.io	7.4.0

Access via TEA

Use the Transparency Exchange API to fetch this SBOM programmatically:

pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]