SBOM for sccache 0.14.0
Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage.
Package information
Available SBOMs
Read from .dist-info/sboms/ in each wheel.
sccache-0.14.0-py3-none-manylinux_2_31_riscv64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
63 known vulnerabilities
Known vulnerabilities
Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in |
|---|---|---|---|
|
CVE-2026-115905
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
|
Critical 10.0 | zip 0.6.6 crates.io |
9.0.5 |
|
RUSTSEC-2026-0369
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
|
Critical 9.1 | zip 0.6.6 crates.io |
9.0.0 |
|
CVE-2026-42327
`X509Ref::ocsp_responders` can produce a `&str` that is not valid UTF-8
|
High 8.7 | openssl 0.10.75 crates.io |
0.10.79 |
|
CVE-2026-31812
Denial of service in Quinn endpoints
|
High 8.7 | quinn-proto 0.11.8 crates.io |
0.11.14 |
|
CVE-2026-41898
Unchecked callback lengths in PSK and cookie callbacks
|
High 8.3 | openssl 0.10.75 crates.io |
0.10.78 |
|
CVE-2026-41681
Buffer overflow in `MdCtxRef::digest_final`
|
High 8.1 | openssl 0.10.75 crates.io |
0.10.78 |
|
CVE-2026-33055
tar-rs incorrectly ignores PAX size headers if header size is nonzero
|
High 8.1 | tar 0.4.40 crates.io |
0.4.45 |
|
RUSTSEC-2026-0194
Quadratic run time when checking a start tag for duplicate attribute names
|
High 7.5 | quick-xml 0.37.5 crates.io |
0.41.0 |
|
RUSTSEC-2026-0194
Quadratic run time when checking a start tag for duplicate attribute names
|
High 7.5 | quick-xml 0.38.4 crates.io |
0.41.0 |
|
RUSTSEC-2026-0195
Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
|
High 7.5 | quick-xml 0.37.5 crates.io |
0.41.0 |
|
RUSTSEC-2026-0195
Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
|
High 7.5 | quick-xml 0.38.4 crates.io |
0.41.0 |
|
CVE-2026-25800
Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
|
High 7.5 | quinn-proto 0.11.8 crates.io |
0.11.15 |
|
RUSTSEC-2026-0340
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
|
High 7.5 | quinn-proto 0.11.8 crates.io |
0.11.18 |
|
CVE-2026-93599
Reachable panic in certificate revocation list parsing
|
High 7.5 | rustls-webpki 0.102.4 crates.io |
0.103.13 |
|
RUSTSEC-2026-0344
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
|
High 7.5 | ruzstd 0.8.1 crates.io |
0.9.1 |
|
CVE-2026-115909
zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size
|
High 7.5 | zip 0.6.6 crates.io |
9.0.0 |
|
RUSTSEC-2026-0367
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
|
High 7.3 | zip 0.6.6 crates.io |
9.0.0 |
|
CVE-2026-41676
Buffer overflow in `Deriver::derive` and `PkeyCtxRef::derive` with OpenSSL 1.1.x
|
High 7.2 | openssl 0.10.75 crates.io |
0.10.78 |
|
CVE-2026-41678
Out-of-bounds write in `aes::unwrap_key`
|
High 7.2 | openssl 0.10.75 crates.io |
0.10.78 |
|
CVE-2026-25727
Denial of Service via Stack Exhaustion
|
Medium 6.8 | time 0.3.36 crates.io |
0.3.47 |
|
CVE-2026-33056
`unpack_in` can chmod arbitrary directories by following symlinks
|
Medium 6.5 | tar 0.4.40 crates.io |
0.4.45 |
|
CVE-2026-115906
zip: AES Entry HMAC Authentication Bypass on Premature EOF
|
Medium 6.5 | zip 0.6.6 crates.io |
9.0.0 |
|
CVE-2024-12224
`idna` accepts Punycode labels that do not produce any non-ASCII when decoded
|
Medium 6.3 | idna 0.5.0 crates.io |
1.0.0 |
|
CVE-2023-49092
Marvin Attack: potential key recovery through timing sidechannels
|
Medium 5.9 | rsa 0.9.10 crates.io |
0.10.0 |
|
CVE-2026-25541
Integer overflow in `BytesMut::reserve`
|
Medium 5.5 | bytes 1.10.1 crates.io |
1.11.1 |
|
CVE-2026-25537
jsonwebtoken has Type Confusion that leads to potential authorization bypass
|
Medium 5.5 | jsonwebtoken 9.2.0 crates.io |
10.3.0 |
|
CVE-2026-44662
Buffer overflow with AES key wrap with padding in `cipher_update`
|
Medium 5.1 | openssl 0.10.75 crates.io |
0.10.79 |
|
CVE-2026-45784
Buffer overflow with AES key wrap with padding in `cipher_update_inplace`
|
Medium 5.1 | openssl 0.10.75 crates.io |
0.10.80 |
|
CVE-2026-93602
CRLs not considered authoritative by Distribution Point due to faulty matching logic
|
Medium 4.4 | rustls-webpki 0.102.4 crates.io |
0.103.10 |
|
CVE-2026-123609
`Debug` impls for client session values expose TLS secrets
|
Medium 4.0 | rustls 0.23.10 crates.io |
0.23.46 |
|
CVE-2026-123610
Brotli certificate decompression can allocate up to 1 GiB before authentication
|
Low 3.7 | rustls 0.23.10 crates.io |
0.23.46 |
|
CVE-2026-123611
Unauthenticated ServerHello can downgrade later connections to classical key exchange
|
Low 3.7 | rustls 0.23.10 crates.io |
0.23.46 |
|
CVE-2026-93600
Name constraints for URI names were incorrectly accepted
|
Low 2.2 | rustls-webpki 0.102.4 crates.io |
0.103.12 |
|
CVE-2026-93601
Name constraints were accepted for certificates asserting a wildcard name
|
Low 2.2 | rustls-webpki 0.102.4 crates.io |
0.103.12 |
|
CVE-2026-41677
Out-of-bounds read when a PEM password callback returns an oversized length
|
Low 1.7 | openssl 0.10.75 crates.io |
0.10.78 |
|
RUSTSEC-2026-0190
Unsoundness in `Error::downcast_mut()`
|
Unknown | anyhow 1.0.100 crates.io |
1.0.103 |
|
RUSTSEC-2025-0141
Bincode is unmaintained
|
Unknown | bincode 1.3.3 crates.io |
— |
|
RUSTSEC-2026-0258
h2 unbounded empty DATA frames
|
Unknown | h2 0.4.5 crates.io |
0.4.16 |
|
RUSTSEC-2026-0186
Unchecked pointer offset in crate `memmap2`
|
Unknown | memmap2 0.9.4 crates.io |
0.9.11 |
|
RUSTSEC-2025-0119
number_prefix crate is unmaintained
|
Unknown | number_prefix 0.4.0 crates.io |
— |
|
RUSTSEC-2026-0441
`pin-utils` is unmaintained
|
Unknown | pin-utils 0.1.0 crates.io |
— |
|
RUSTSEC-2026-0338
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
|
Unknown | quinn-proto 0.11.8 crates.io |
0.11.18 |
|
RUSTSEC-2026-0339
Unbounded growth of pending connection ID retirements in quinn-proto
|
Unknown | quinn-proto 0.11.8 crates.io |
0.11.17 |
|
RUSTSEC-2026-0342
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
|
Unknown | quinn-proto 0.11.8 crates.io |
0.11.17 |
|
RUSTSEC-2026-0097
Rand is unsound with a custom logger using `rand::rng()`
|
Unknown | rand 0.8.5 crates.io |
0.8.6 |
|
RUSTSEC-2026-0097
Rand is unsound with a custom logger using `rand::rng()`
|
Unknown | rand 0.9.2 crates.io |
0.9.3 |
|
RUSTSEC-2025-0134
rustls-pemfile is unmaintained
|
Unknown | rustls-pemfile 2.1.2 crates.io |
— |
|
CVE-2026-111943
Certificate verification may accept distrusted intermediates
|
Unknown | rustls-webpki 0.102.4 crates.io |
0.103.16 |
|
GHSA-3pv8-6f4r-ffg2
tar has a PAX header desynchronization issue
|
Unknown | tar 0.4.40 crates.io |
0.4.46 |
|
RUSTSEC-2026-0386
`AsyncFd::new` and related constructors violate I/O safety
|
Unknown | tokio 1.49.0 crates.io |
1.51.6 |
|
CVE-2026-111943
Bundled root certificates allow trust in distrusted emSign intermediates
|
Unknown | webpki-roots 0.26.2 crates.io |
0.26.11 |
|
CVE-2026-111943
Bundled root certificates allow trust in distrusted emSign intermediates
|
Unknown | webpki-roots 1.0.5 crates.io |
1.0.10 |
|
RUSTSEC-2026-0368
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
|
Unknown | zip 0.6.6 crates.io |
9.0.0 |
|
RUSTSEC-2026-0395
Use-after-free with `CParameter::StableInBuffer`
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0397
`OutBuffer::around_pos` exposes uninitialized memory
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0399
Use-after-free through `init_using_cdict` and `init_using_ddict`
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0400
Use-after-free of a dictionary after a one-shot call on a context with an open stream
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0401
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0402
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0403
Uninitialized memory exposed when streaming decompression of a legacy frame fails
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0404
Double free in `DCtx::try_clone`
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0406
Use-after-free when changing a multithreaded context with an unfinished frame
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0410
WebAssembly allocator shim corrupts memory on allocation failure
|
Unknown | zstd-sys 2.0.10+zstd.1.5.6 crates.io |
2.1.2 |
Access via TEA
Use the Transparency Exchange API to fetch this SBOM programmatically:
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]