# SBOM for rustworkx 0.18.1

> A High-Performance Graph Library for Python

The Python package rustworkx 0.18.1 ships 22 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/rustworkx@0.18.1`
- PyPI: https://pypi.org/project/rustworkx/0.18.1/
- Requires Python: \>=3.10
- documentation: <https://www.rustworkx.org/>
- issues: <https://github.com/Qiskit/rustworkx/issues>
- releasenotes: <https://www.rustworkx.org/release_notes.html>
- source: <https://github.com/Qiskit/rustworkx>

## SBOMs

### rustworkx-0.18.1-cp310-abi3-macosx\_10\_12\_x86\_64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/bc03faff-e074-5a79-a831-8aadda821d47/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/fc98636f-6b88-5795-a27d-9497ad0bec9a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/a59e9b84-7b66-559e-b030-25ed10563351/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/30c2151a-8b08-5d10-8755-fe7df5205589/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-manylinux\_2\_28\_ppc64le.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/79f4d818-ba1a-5efa-a5f9-c93c2807703f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-manylinux\_2\_28\_s390x.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/f8d7d423-da0c-58aa-a341-a4d50bea4a09/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d2c3035a-6c4a-5dea-8850-2ebda447bbc2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/4be1e6e5-9134-52ae-a024-e734b14f458f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/066d5b5d-b2e8-5c30-b366-77f0d7ac5173/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/e7217110-6e03-50ac-9e07-d42832b398e0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-pyemscripten\_2026\_0\_wasm32.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/f6584ffc-12ea-503e-9cbb-de6e84f23fcf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-win32.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/027ce045-b067-597f-b6c2-8cba6ef267db/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 4 known vulnerabilities

### rustworkx-0.18.1-cp310-abi3-win\_amd64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/016302cc-7276-55ce-a89f-ef5a0dc3165b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-macosx\_10\_15\_x86\_64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/9699c144-e710-5706-b67e-ec2ec173047c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-macosx\_11\_0\_arm64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/634cf948-8fdb-5ffc-a072-68faa26c446b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/00c9ee13-2ffb-57de-a678-38c17d98b494/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/52932f2e-17cf-5fc3-a15d-12a3aec1d302/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-manylinux\_2\_28\_ppc64le.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/725b9c5b-bc2b-57af-af23-b389178bb06c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d12c254c-7c20-5041-b1b6-0a70f8ae5789/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/d71e4917-c45d-56a9-8c2f-3e6d519cd6b7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### rustworkx-0.18.1-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, Qiskit/rustworkx, workflow wheels.yml).

- [rustworkx-0.18.1.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/c194f24f-16d3-54a2-884e-f68682221a9f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, no known vulnerabilities
- [rustworkx-0.18.1.dist-info/sboms/rustworkx.cyclonedx.json](https://pypi.sbomify.com/artifact/3c99868f-2173-582a-b122-96397baab320/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.37.5 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.37.5 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/rustworkx@0.18.1
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/rustworkx/0.18.1.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/rustworkx/0.18.1