# SBOM for schiebung 0.5.2 > Python bindings for the schiebung core library The Python package schiebung 0.5.2 ships 18 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/schiebung@0.5.2` - PyPI: https://pypi.org/project/schiebung/0.5.2/ - Author: Michael Maerz - License: MIT - Requires Python: \>=3.8 - Bug Tracker: - Homepage: - Repository: ## SBOMs ### schiebung-0.5.2-cp312-abi3-macosx\_11\_0\_arm64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/421769bd-ef13-5fb8-b937-b90fe1feaf73/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/00371f7d-bc54-5c3a-a339-e623a3c1013d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/dc4c45e1-6ea2-561c-b802-e172605d9e6a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/50436164-2f56-5d6d-91e0-5e3df46bc0ad/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/cc421b7a-6074-5891-8e15-d6b5a1e9cd88/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-musllinux\_1\_2\_aarch64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/1008555c-b716-5e82-8710-ff98db4c009e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-musllinux\_1\_2\_x86\_64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ab0a5ace-f2b2-51a4-9ef9-535022def61c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-win32.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/541d20d2-ac72-5ff9-b27f-12714bc81408/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp312-abi3-win\_amd64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/648c2252-8d4c-5a3e-8ecb-f7b3b9c19751/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-macosx\_11\_0\_arm64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/747458e0-5aa3-57b3-b968-5a4f082b43a5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/777fd99b-8bc1-59f2-b97f-b0d5336809d6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3b605d74-b058-55e6-a20b-83101af4ddbb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-manylinux\_2\_17\_i686.manylinux2014\_i686.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/a60cf1d5-2252-5001-8841-49b57aa43db1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/05c8ce06-aa0d-5d00-a95a-74bcd0716f59/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-musllinux\_1\_2\_aarch64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/08c727fc-832e-595e-8bdc-d9949d41b6c9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/311a8108-a86c-5aa6-9614-af0e54f58f34/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-win32.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/010616f5-8074-5956-b879-816325aecbee/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ### schiebung-0.5.2-cp314-cp314t-win\_amd64.whl - [schiebung-0.5.2.dist-info/sboms/schiebung-py.cyclonedx.json](https://pypi.sbomify.com/artifact/3a4d3a8b-36bf-5000-a1a8-223e1ed30669/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.27.2 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators | | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.36.2 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.36.2 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.27.2 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures | | [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/schiebung@0.5.2 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/schiebung/0.5.2.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/schiebung/0.5.2