# SBOM for sccache 0.16.0 > Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage. The Python package sccache 0.16.0 ships 9 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/sccache@0.16.0` - PyPI: https://pypi.org/project/sccache/0.16.0/ - License: Apache-2.0 - Source Code: ## SBOMs ### sccache-0.16.0-py3-none-macosx\_10\_12\_x86\_64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/c8f4a51d-bd8e-54a1-b59d-6cab8b9bcd34/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 53 known vulnerabilities ### sccache-0.16.0-py3-none-macosx\_11\_0\_arm64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/c62d5481-0825-5070-ac27-dbd3553fe784/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 53 known vulnerabilities ### sccache-0.16.0-py3-none-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/d538db3d-feb3-5c2e-b636-de68ea3f4fcd/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 61 known vulnerabilities ### sccache-0.16.0-py3-none-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/a6c0b154-237c-5e66-bbc3-fb7a8c9e2259/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 61 known vulnerabilities ### sccache-0.16.0-py3-none-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/ea8c88e1-e21f-570c-9577-ade84423ee74/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 65 known vulnerabilities ### sccache-0.16.0-py3-none-manylinux\_2\_31\_riscv64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/5da33997-fd8c-5c4e-a378-b6e3fd48427c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 61 known vulnerabilities ### sccache-0.16.0-py3-none-win32.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/1a99ac82-faf8-53ea-aebd-0d40260a40f5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 53 known vulnerabilities ### sccache-0.16.0-py3-none-win\_amd64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/6d6d118e-21af-5495-8327-398982453d84/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 53 known vulnerabilities ### sccache-0.16.0-py3-none-win\_arm64.whl - [sccache-0.16.0.dist-info/sboms/sccache.cyclonedx.json](https://pypi.sbomify.com/artifact/1ef6caf3-4de3-5bba-a3ba-150731f2f14a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 53 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/) | critical (10.0) | zip 0.6.6 (crates.io) | 9.0.5 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | | [RUSTSEC-2026-0369](https://osv.dev/vulnerability/RUSTSEC-2026-0369) | critical (9.1) | zip 0.6.6 (crates.io) | 9.0.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target | | [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/) | high (8.7) | openssl 0.10.75 (crates.io) | 0.10.79 | rust-openssl has undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs | | [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/) | high (8.3) | openssl 0.10.75 (crates.io) | 0.10.78 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer | | [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/) | high (8.1) | openssl 0.10.75 (crates.io) | 0.10.78 | rust-openssl: rustMdCtxRef::digest\_final() writes past caller buffer with no length check | | [CVE-2026-33055](https://insights.sbomify.com/CVE-2026-33055/) | high (8.1) | tar 0.4.40 (crates.io) | 0.4.45 | tar-rs incorrectly ignores PAX size headers if header size is nonzero | | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.37.5 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.37.5 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.38.4 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [CVE-2026-25800](https://insights.sbomify.com/CVE-2026-25800/) | high (7.5) | quinn-proto 0.11.14 (crates.io) | 0.11.15 | Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly | | [RUSTSEC-2026-0340](https://osv.dev/vulnerability/RUSTSEC-2026-0340) | high (7.5) | quinn-proto 0.11.14 (crates.io) | 0.11.18 | Peer minimum ACK delay can panic quinn-proto when ACK\_FREQUENCY transmission is enabled | | [CVE-2026-93599](https://insights.sbomify.com/CVE-2026-93599/) | high (7.5) | rustls-webpki 0.102.4 (crates.io) | 0.103.13 | Reachable panic in certificate revocation list parsing | | [RUSTSEC-2026-0344](https://osv.dev/vulnerability/RUSTSEC-2026-0344) | high (7.5) | ruzstd 0.8.1 (crates.io) | 0.9.1 | Decompression bomb in \`ruzstd\`: a tiny input can exhaust memory (OOM) | | [CVE-2026-115909](https://insights.sbomify.com/CVE-2026-115909/) | high (7.5) | zip 0.6.6 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` aborts the process on a symlink entry with a large declared size | | [RUSTSEC-2026-0367](https://osv.dev/vulnerability/RUSTSEC-2026-0367) | high (7.3) | zip 0.6.6 (crates.io) | 9.0.0 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation | | [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/) | high (7.2) | openssl 0.10.75 (crates.io) | 0.10.78 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 | | [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/) | high (7.2) | openssl 0.10.75 (crates.io) | 0.10.78 | Out-of-bounds write in \`aes::unwrap\_key\` | | [CVE-2026-25727](https://insights.sbomify.com/CVE-2026-25727/) | medium (6.8) | time 0.3.36 (crates.io) | 0.3.47 | Denial of Service via Stack Exhaustion | | [CVE-2026-33056](https://insights.sbomify.com/CVE-2026-33056/) | medium (6.5) | tar 0.4.40 (crates.io) | 0.4.45 | \`unpack\_in\` can chmod arbitrary directories by following symlinks | | [CVE-2026-115906](https://insights.sbomify.com/CVE-2026-115906/) | medium (6.5) | zip 0.6.6 (crates.io) | 9.0.0 | zip: AES Entry HMAC Authentication Bypass on Premature EOF | | [CVE-2023-49092](https://insights.sbomify.com/CVE-2023-49092/) | medium (5.9) | rsa 0.9.10 (crates.io) | 0.10.0 | Marvin Attack: potential key recovery through timing sidechannels | | [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/) | medium (5.5) | bytes 1.10.1 (crates.io) | 1.11.1 | Integer overflow in \`BytesMut::reserve\` | | [CVE-2026-25537](https://insights.sbomify.com/CVE-2026-25537/) | medium (5.5) | jsonwebtoken 9.2.0 (crates.io) | 10.3.0 | jsonwebtoken has Type Confusion that leads to potential authorization bypass | | [CVE-2026-44662](https://insights.sbomify.com/CVE-2026-44662/) | medium (5.1) | openssl 0.10.75 (crates.io) | 0.10.79 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding | | [CVE-2026-45784](https://insights.sbomify.com/CVE-2026-45784/) | medium (5.1) | openssl 0.10.75 (crates.io) | 0.10.80 | rust-openssl: Potential out-of-bounds write in \`CipherCtxRef::cipher\_update\_inplace\` for AES-KW-PAD ciphers | | [CVE-2026-93602](https://insights.sbomify.com/CVE-2026-93602/) | medium (4.4) | rustls-webpki 0.102.4 (crates.io) | 0.103.10 | CRLs not considered authoritative by Distribution Point due to faulty matching logic | | [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.10 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets | | [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.10 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication | | [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.10 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | | [CVE-2026-93600](https://insights.sbomify.com/CVE-2026-93600/) | low (2.2) | rustls-webpki 0.102.4 (crates.io) | 0.103.12 | Name constraints for URI names were incorrectly accepted | | [CVE-2026-93601](https://insights.sbomify.com/CVE-2026-93601/) | low (2.2) | rustls-webpki 0.102.4 (crates.io) | 0.103.12 | Name constraints were accepted for certificates asserting a wildcard name | | [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/) | low (1.7) | openssl 0.10.75 (crates.io) | 0.10.78 | rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length | | [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.100 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` | | [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained | | [RUSTSEC-2023-0028](https://osv.dev/vulnerability/RUSTSEC-2023-0028) | unknown | buf\_redux 0.8.4 (crates.io) | none listed | buf\_redux is Unmaintained | | [RUSTSEC-2026-0258](https://osv.dev/vulnerability/RUSTSEC-2026-0258) | unknown | h2 0.4.5 (crates.io) | 0.4.16 | h2 unbounded empty DATA frames | | [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.4 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` | | [RUSTSEC-2023-0050](https://osv.dev/vulnerability/RUSTSEC-2023-0050) | unknown | multipart 0.18.0 (crates.io) | none listed | multipart is Unmaintained | | [RUSTSEC-2025-0119](https://osv.dev/vulnerability/RUSTSEC-2025-0119) | unknown | number\_prefix 0.4.0 (crates.io) | none listed | number\_prefix crate is unmaintained | | [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained | | [RUSTSEC-2026-0338](https://osv.dev/vulnerability/RUSTSEC-2026-0338) | unknown | quinn-proto 0.11.14 (crates.io) | 0.11.18 | Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads | | [RUSTSEC-2026-0339](https://osv.dev/vulnerability/RUSTSEC-2026-0339) | unknown | quinn-proto 0.11.14 (crates.io) | 0.11.17 | Unbounded growth of pending connection ID retirements in quinn-proto | | [RUSTSEC-2026-0342](https://osv.dev/vulnerability/RUSTSEC-2026-0342) | unknown | quinn-proto 0.11.14 (crates.io) | 0.11.17 | Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.9.2 (crates.io) | 0.9.3 | Rand is unsound with a custom logger using \`rand::rng()\` | | [RUSTSEC-2025-0134](https://osv.dev/vulnerability/RUSTSEC-2025-0134) | unknown | rustls-pemfile 2.1.2 (crates.io) | none listed | rustls-pemfile is unmaintained | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.102.4 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates | | [RUSTSEC-2023-0081](https://osv.dev/vulnerability/RUSTSEC-2023-0081) | unknown | safemem 0.3.3 (crates.io) | none listed | safemem is unmaintained | | [GHSA-3pv8-6f4r-ffg2](https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2) | unknown | tar 0.4.40 (crates.io) | 0.4.46 | tar has a PAX header desynchronization issue | | [RUSTSEC-2026-0386](https://osv.dev/vulnerability/RUSTSEC-2026-0386) | unknown | tokio 1.49.0 (crates.io) | 1.51.6 | \`AsyncFd::new\` and related constructors violate I/O safety | | [RUSTSEC-2021-0146](https://osv.dev/vulnerability/RUSTSEC-2021-0146) | unknown | twoway 0.1.8 (crates.io) | none listed | Crate \`twoway\` deprecated by the author | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 0.26.2 (crates.io) | 0.26.11 | Bundled root certificates allow trust in distrusted emSign intermediates | | [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 1.0.5 (crates.io) | 1.0.10 | Bundled root certificates allow trust in distrusted emSign intermediates | | [RUSTSEC-2026-0368](https://osv.dev/vulnerability/RUSTSEC-2026-0368) | unknown | zip 0.6.6 (crates.io) | 9.0.0 | zip: \`ZipArchive::extract\` creates symbolic links whose attacker-controlled targets are outside the destination directory | | [RUSTSEC-2026-0395](https://osv.dev/vulnerability/RUSTSEC-2026-0395) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Use-after-free with \`CParameter::StableInBuffer\` | | [RUSTSEC-2026-0397](https://osv.dev/vulnerability/RUSTSEC-2026-0397) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | \`OutBuffer::around\_pos\` exposes uninitialized memory | | [RUSTSEC-2026-0399](https://osv.dev/vulnerability/RUSTSEC-2026-0399) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Use-after-free through \`init\_using\_cdict\` and \`init\_using\_ddict\` | | [RUSTSEC-2026-0400](https://osv.dev/vulnerability/RUSTSEC-2026-0400) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Use-after-free of a dictionary after a one-shot call on a context with an open stream | | [RUSTSEC-2026-0401](https://osv.dev/vulnerability/RUSTSEC-2026-0401) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Out-of-bounds read in \`train\_from\_buffer\` when sample sizes overflow | | [RUSTSEC-2026-0402](https://osv.dev/vulnerability/RUSTSEC-2026-0402) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Heap buffer overflow in \`CCtx::try\_clone\` on a multithreaded context | | [RUSTSEC-2026-0403](https://osv.dev/vulnerability/RUSTSEC-2026-0403) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Uninitialized memory exposed when streaming decompression of a legacy frame fails | | [RUSTSEC-2026-0404](https://osv.dev/vulnerability/RUSTSEC-2026-0404) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Double free in \`DCtx::try\_clone\` | | [RUSTSEC-2026-0406](https://osv.dev/vulnerability/RUSTSEC-2026-0406) | unknown | zstd-safe 7.1.0 (crates.io) | 7.4.0 | Use-after-free when changing a multithreaded context with an unfinished frame | | [RUSTSEC-2026-0410](https://osv.dev/vulnerability/RUSTSEC-2026-0410) | unknown | zstd-sys 2.0.10+zstd.1.5.6 (crates.io) | 2.1.2 | WebAssembly allocator shim corrupts memory on allocation failure | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/sccache@0.16.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/sccache/0.16.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/sccache/0.16.0