SBOM for sccache 0.16.0
Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage.
Package information
Available SBOMs
Read from .dist-info/sboms/ in each wheel.
sccache-0.16.0-py3-none-macosx_10_12_x86_64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
sccache-0.16.0-py3-none-macosx_11_0_arm64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
sccache-0.16.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
61 known vulnerabilities
sccache-0.16.0-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
61 known vulnerabilities
sccache-0.16.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
65 known vulnerabilities
sccache-0.16.0-py3-none-manylinux_2_31_riscv64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
61 known vulnerabilities
sccache-0.16.0-py3-none-win32.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
sccache-0.16.0-py3-none-win_amd64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
sccache-0.16.0-py3-none-win_arm64.whl
Valid
Download
sccache.cyclonedx.json
CycloneDX/1.5
application/vnd.cyclonedx+json
53 known vulnerabilities
Known vulnerabilities
Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in |
|---|---|---|---|
|
CVE-2026-115905
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
|
Critical 10.0 | zip 0.6.6 crates.io |
9.0.5 |
|
RUSTSEC-2026-0369
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
|
Critical 9.1 | zip 0.6.6 crates.io |
9.0.0 |
|
CVE-2026-42327
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
|
High 8.7 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.79 |
|
CVE-2026-41898
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
|
High 8.3 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.78 |
|
CVE-2026-41681
rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
|
High 8.1 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.78 |
|
CVE-2026-33055
tar-rs incorrectly ignores PAX size headers if header size is nonzero
|
High 8.1 | tar 0.4.40 crates.io |
0.4.45 |
|
RUSTSEC-2026-0194
Quadratic run time when checking a start tag for duplicate attribute names
|
High 7.5 | quick-xml 0.37.5 crates.io |
0.41.0 |
|
RUSTSEC-2026-0194
Quadratic run time when checking a start tag for duplicate attribute names
|
High 7.5 | quick-xml 0.38.4 crates.io |
0.41.0 |
|
RUSTSEC-2026-0195
Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
|
High 7.5 | quick-xml 0.37.5 crates.io |
0.41.0 |
|
RUSTSEC-2026-0195
Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
|
High 7.5 | quick-xml 0.38.4 crates.io |
0.41.0 |
|
CVE-2026-25800
Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
|
High 7.5 | quinn-proto 0.11.14 crates.io |
0.11.15 |
|
RUSTSEC-2026-0340
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
|
High 7.5 | quinn-proto 0.11.14 crates.io |
0.11.18 |
|
CVE-2026-93599
Reachable panic in certificate revocation list parsing
|
High 7.5 | rustls-webpki 0.102.4 crates.io |
0.103.13 |
|
RUSTSEC-2026-0344
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
|
High 7.5 | ruzstd 0.8.1 crates.io |
0.9.1 |
|
CVE-2026-115909
zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size
|
High 7.5 | zip 0.6.6 crates.io |
9.0.0 |
|
RUSTSEC-2026-0367
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
|
High 7.3 | zip 0.6.6 crates.io |
9.0.0 |
|
CVE-2026-41676
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
|
High 7.2 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.78 |
|
CVE-2026-41678
Out-of-bounds write in `aes::unwrap_key`
|
High 7.2 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.78 |
|
CVE-2026-25727
Denial of Service via Stack Exhaustion
|
Medium 6.8 | time 0.3.36 crates.io |
0.3.47 |
|
CVE-2026-33056
`unpack_in` can chmod arbitrary directories by following symlinks
|
Medium 6.5 | tar 0.4.40 crates.io |
0.4.45 |
|
CVE-2026-115906
zip: AES Entry HMAC Authentication Bypass on Premature EOF
|
Medium 6.5 | zip 0.6.6 crates.io |
9.0.0 |
|
CVE-2023-49092
Marvin Attack: potential key recovery through timing sidechannels
|
Medium 5.9 | rsa 0.9.10 crates.io |
0.10.0 |
|
CVE-2026-25541
Integer overflow in `BytesMut::reserve`
|
Medium 5.5 | bytes 1.10.1 crates.io |
1.11.1 |
|
CVE-2026-25537
jsonwebtoken has Type Confusion that leads to potential authorization bypass
|
Medium 5.5 | jsonwebtoken 9.2.0 crates.io |
10.3.0 |
|
CVE-2026-44662
rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
|
Medium 5.1 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.79 |
|
CVE-2026-45784
rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
|
Medium 5.1 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.80 |
|
CVE-2026-93602
CRLs not considered authoritative by Distribution Point due to faulty matching logic
|
Medium 4.4 | rustls-webpki 0.102.4 crates.io |
0.103.10 |
|
CVE-2026-123609
`Debug` impls for client session values expose TLS secrets
|
Medium 4.0 | rustls 0.23.10 crates.io |
0.23.46 |
|
CVE-2026-123610
Brotli certificate decompression can allocate up to 1 GiB before authentication
|
Low 3.7 | rustls 0.23.10 crates.io |
0.23.46 |
|
CVE-2026-123611
Unauthenticated ServerHello can downgrade later connections to classical key exchange
|
Low 3.7 | rustls 0.23.10 crates.io |
0.23.46 |
|
CVE-2026-93600
Name constraints for URI names were incorrectly accepted
|
Low 2.2 | rustls-webpki 0.102.4 crates.io |
0.103.12 |
|
CVE-2026-93601
Name constraints were accepted for certificates asserting a wildcard name
|
Low 2.2 | rustls-webpki 0.102.4 crates.io |
0.103.12 |
|
CVE-2026-41677
rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length
|
Low 1.7 | openssl 0.10.75 crates.io · 4 of 9 wheels |
0.10.78 |
|
RUSTSEC-2026-0190
Unsoundness in `Error::downcast_mut()`
|
Unknown | anyhow 1.0.100 crates.io |
1.0.103 |
|
RUSTSEC-2025-0141
Bincode is unmaintained
|
Unknown | bincode 1.3.3 crates.io |
— |
|
RUSTSEC-2023-0028
buf_redux is Unmaintained
|
Unknown | buf_redux 0.8.4 crates.io · 1 of 9 wheels |
— |
|
RUSTSEC-2026-0258
h2 unbounded empty DATA frames
|
Unknown | h2 0.4.5 crates.io |
0.4.16 |
|
RUSTSEC-2026-0186
Unchecked pointer offset in crate `memmap2`
|
Unknown | memmap2 0.9.4 crates.io |
0.9.11 |
|
RUSTSEC-2023-0050
multipart is Unmaintained
|
Unknown | multipart 0.18.0 crates.io · 1 of 9 wheels |
— |
|
RUSTSEC-2025-0119
number_prefix crate is unmaintained
|
Unknown | number_prefix 0.4.0 crates.io |
— |
|
RUSTSEC-2026-0441
`pin-utils` is unmaintained
|
Unknown | pin-utils 0.1.0 crates.io |
— |
|
RUSTSEC-2026-0338
Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads
|
Unknown | quinn-proto 0.11.14 crates.io |
0.11.18 |
|
RUSTSEC-2026-0339
Unbounded growth of pending connection ID retirements in quinn-proto
|
Unknown | quinn-proto 0.11.14 crates.io |
0.11.17 |
|
RUSTSEC-2026-0342
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
|
Unknown | quinn-proto 0.11.14 crates.io |
0.11.17 |
|
RUSTSEC-2026-0097
Rand is unsound with a custom logger using `rand::rng()`
|
Unknown | rand 0.8.5 crates.io |
0.8.6 |
|
RUSTSEC-2026-0097
Rand is unsound with a custom logger using `rand::rng()`
|
Unknown | rand 0.9.2 crates.io |
0.9.3 |
|
RUSTSEC-2025-0134
rustls-pemfile is unmaintained
|
Unknown | rustls-pemfile 2.1.2 crates.io |
— |
|
CVE-2026-111943
Certificate verification may accept distrusted intermediates
|
Unknown | rustls-webpki 0.102.4 crates.io |
0.103.16 |
|
RUSTSEC-2023-0081
safemem is unmaintained
|
Unknown | safemem 0.3.3 crates.io · 1 of 9 wheels |
— |
|
GHSA-3pv8-6f4r-ffg2
tar has a PAX header desynchronization issue
|
Unknown | tar 0.4.40 crates.io |
0.4.46 |
|
RUSTSEC-2026-0386
`AsyncFd::new` and related constructors violate I/O safety
|
Unknown | tokio 1.49.0 crates.io |
1.51.6 |
|
RUSTSEC-2021-0146
Crate `twoway` deprecated by the author
|
Unknown | twoway 0.1.8 crates.io · 1 of 9 wheels |
— |
|
CVE-2026-111943
Bundled root certificates allow trust in distrusted emSign intermediates
|
Unknown | webpki-roots 0.26.2 crates.io |
0.26.11 |
|
CVE-2026-111943
Bundled root certificates allow trust in distrusted emSign intermediates
|
Unknown | webpki-roots 1.0.5 crates.io |
1.0.10 |
|
RUSTSEC-2026-0368
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
|
Unknown | zip 0.6.6 crates.io |
9.0.0 |
|
RUSTSEC-2026-0395
Use-after-free with `CParameter::StableInBuffer`
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0397
`OutBuffer::around_pos` exposes uninitialized memory
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0399
Use-after-free through `init_using_cdict` and `init_using_ddict`
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0400
Use-after-free of a dictionary after a one-shot call on a context with an open stream
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0401
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0402
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0403
Uninitialized memory exposed when streaming decompression of a legacy frame fails
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0404
Double free in `DCtx::try_clone`
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0406
Use-after-free when changing a multithreaded context with an unfinished frame
|
Unknown | zstd-safe 7.1.0 crates.io |
7.4.0 |
|
RUSTSEC-2026-0410
WebAssembly allocator shim corrupts memory on allocation failure
|
Unknown | zstd-sys 2.0.10+zstd.1.5.6 crates.io |
2.1.2 |
Access via TEA
Use the Transparency Exchange API to fetch this SBOM programmatically:
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]