# SBOM for pyzsync 1.5.4 > A Python module written in Rust that implements the zsync algorithm The Python package pyzsync 1.5.4 ships 22 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/pyzsync@1.5.4` - PyPI: https://pypi.org/project/pyzsync/1.5.4/ - Requires Python: \>=3.10 ## SBOMs ### pyzsync-1.5.4-cp310-cp310-manylinux\_2\_34\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/b82be261-34b3-5c46-b746-e0953139e587/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp310-cp310-win\_amd64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/904394d6-f6f0-54b6-8c71-0e4d057d8720/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp311-cp311-macosx\_10\_12\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/d4364933-759b-51f5-9006-127671cc6bbd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp311-cp311-macosx\_11\_0\_arm64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/97fc7e98-8777-586b-a04f-42cab4a02764/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp311-cp311-manylinux\_2\_34\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/811d5609-c8aa-55bf-977a-19b801e37ead/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp311-cp311-win\_amd64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/8412b954-ae9e-551b-8c2b-83fbe55c81e2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp312-cp312-macosx\_10\_12\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/d2307f80-c18d-586d-995f-2f815f1ee316/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp312-cp312-macosx\_11\_0\_arm64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/be02c386-91b0-5893-a7bb-bb635f41889c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp312-cp312-manylinux\_2\_34\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/3d92985e-9886-56ac-b4f3-31dcb9bda0f1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp312-cp312-win\_amd64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/142b7399-ad17-54d2-87c4-1010c97f7bb9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp313-cp313-macosx\_10\_12\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/bdd62951-885c-5a56-acbc-a0899107acf4/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp313-cp313-macosx\_11\_0\_arm64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/0214a730-b2d8-5418-bde4-e8daff44736b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp313-cp313-manylinux\_2\_34\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/762b86ff-6106-5fc3-a10c-614afa63e125/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp313-cp313-win\_amd64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/793cf80a-d480-5d8b-b9dd-60f2b62c9107/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314-macosx\_10\_12\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/1e632cb1-73b8-57f4-86d3-11b17f3f8266/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314-macosx\_11\_0\_arm64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/e9110390-5027-572b-856b-432fb7313b6e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314-manylinux\_2\_34\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/b12fab03-3aef-5a6e-accc-c4ddc9295d89/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314-win\_amd64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/e8b1c5fa-48cc-51fd-a084-ed6f93b4e6dd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314t-macosx\_10\_12\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/cfd48aea-dbf5-5290-8464-9bb6c4e1857c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314t-macosx\_11\_0\_arm64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/9caa4e35-1b0e-5f27-8502-75a4f07875e9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314t-manylinux\_2\_34\_x86\_64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/1be13f3f-b5fe-5971-aec6-3e7514246d6d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ### pyzsync-1.5.4-cp314-cp314t-win\_amd64.whl - [pyzsync-1.5.4.dist-info/sboms/pyzsync.cyclonedx.json](https://pypi.sbomify.com/artifact/672c8ff7-3761-5e3d-bcb3-34666fc539de/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 3 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.28.3 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [GHSA-qwgh-2vcv-g2f7](https://osv.dev/vulnerability/GHSA-qwgh-2vcv-g2f7) | medium (6.3) | block-buffer 0.12.0 (crates.io) | none listed | block\_buffer: panic corrupts inline buffer position | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.28.3 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/pyzsync@1.5.4 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/pyzsync/1.5.4.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/pyzsync/1.5.4