{"url":"https://pypi.sbomify.com/package/surtgis/1.8.1","markdown_url":"https://pypi.sbomify.com/package/surtgis/1.8.1.md","name":"surtgis","version":"1.8.1","purl":"pkg:pypi/surtgis@1.8.1","summary":"High-performance geospatial analysis library for Python, powered by Rust","author":null,"project_urls":{"Bug Tracker":"https://github.com/franciscoparrao/surtgis/issues","Documentation":"https://docs.rs/surtgis","Homepage":"https://github.com/franciscoparrao/surtgis","Repository":"https://github.com/franciscoparrao/surtgis"},"requires_python":">=3.9","license":"MIT OR Apache-2.0","classifiers":["Development Status :: 4 - Beta","Intended Audience :: Developers","Intended Audience :: Science/Research","License :: OSI Approved :: Apache Software License","License :: OSI Approved :: MIT License","Operating System :: MacOS","Operating System :: Microsoft :: Windows","Operating System :: POSIX :: Linux","Programming Language :: Python :: 3","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.9","Programming Language :: Rust","Topic :: Scientific/Engineering :: GIS","Topic :: Scientific/Engineering :: Image Processing"],"wheels":[{"filename":"surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/da/93/d684de9f288be34b2a49044ef43bf29a5d925220992a590bfc37fa721a3f/surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"5ea43129-296d-5fa0-9df1-e7770c0c2ba0","path":"surtgis-1.8.1.dist-info/sboms/surtgis-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/5ea43129-296d-5fa0-9df1-e7770c0c2ba0/download","vulnerability_count":17,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"franciscoparrao/surtgis","workflow":"python-release.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.10":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/franciscoparrao/surtgis","1.3.6.1.4.1.57264.1.13":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.14":"refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.15":"1145472989","1.3.6.1.4.1.57264.1.16":"https://github.com/franciscoparrao","1.3.6.1.4.1.57264.1.17":"73546639","1.3.6.1.4.1.57264.1.18":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.19":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/franciscoparrao/surtgis/actions/runs/42323859809/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/60/8e/71641f3625991dcf94fe6b2af0199339e8d8c3a01ca2a955092865b4f968/surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"0ebc6f96-9896-5374-8453-c42ce5526c2d","path":"surtgis-1.8.1.dist-info/sboms/surtgis-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/0ebc6f96-9896-5374-8453-c42ce5526c2d/download","vulnerability_count":17,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"franciscoparrao/surtgis","workflow":"python-release.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.10":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/franciscoparrao/surtgis","1.3.6.1.4.1.57264.1.13":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.14":"refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.15":"1145472989","1.3.6.1.4.1.57264.1.16":"https://github.com/franciscoparrao","1.3.6.1.4.1.57264.1.17":"73546639","1.3.6.1.4.1.57264.1.18":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.19":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/franciscoparrao/surtgis/actions/runs/42323859809/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","url":"https://files.pythonhosted.org/packages/f5/39/e961d36cd1eb1b212ea7f6653e6390bab6cb07671f4e1414c2985b3fd2d3/surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","sboms":[{"artifact_uuid":"c7fc5e6c-ee56-552a-9ad4-1eb134f239d9","path":"surtgis-1.8.1.dist-info/sboms/surtgis-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/c7fc5e6c-ee56-552a-9ad4-1eb134f239d9/download","vulnerability_count":17,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"franciscoparrao/surtgis","workflow":"python-release.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.10":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/franciscoparrao/surtgis","1.3.6.1.4.1.57264.1.13":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.14":"refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.15":"1145472989","1.3.6.1.4.1.57264.1.16":"https://github.com/franciscoparrao","1.3.6.1.4.1.57264.1.17":"73546639","1.3.6.1.4.1.57264.1.18":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.19":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/franciscoparrao/surtgis/actions/runs/42323859809/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","url":"https://files.pythonhosted.org/packages/b2/e3/a6e8ff94dd8ba5ecc778675d8c20cdd2c3d255632e4165d0ebf0287ff391/surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","sboms":[{"artifact_uuid":"ece3181c-83ec-5dd8-b475-037338543643","path":"surtgis-1.8.1.dist-info/sboms/surtgis-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/ece3181c-83ec-5dd8-b475-037338543643/download","vulnerability_count":17,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"franciscoparrao/surtgis","workflow":"python-release.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.10":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/franciscoparrao/surtgis","1.3.6.1.4.1.57264.1.13":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.14":"refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.15":"1145472989","1.3.6.1.4.1.57264.1.16":"https://github.com/franciscoparrao","1.3.6.1.4.1.57264.1.17":"73546639","1.3.6.1.4.1.57264.1.18":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.19":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/franciscoparrao/surtgis/actions/runs/42323859809/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"surtgis-1.8.1-cp39-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/16/40/d2c78a3f2df1083706273f3a1d5c6b34ae5a6574aa414eef2e9d1aee29ae/surtgis-1.8.1-cp39-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"e2c4d575-d77e-5fc8-a1d5-eff8aff00bf6","path":"surtgis-1.8.1.dist-info/sboms/surtgis-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/e2c4d575-d77e-5fc8-a1d5-eff8aff00bf6/download","vulnerability_count":17,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"franciscoparrao/surtgis","workflow":"python-release.yml","environment":"pypi","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.10":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/franciscoparrao/surtgis","1.3.6.1.4.1.57264.1.13":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.14":"refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.15":"1145472989","1.3.6.1.4.1.57264.1.16":"https://github.com/franciscoparrao","1.3.6.1.4.1.57264.1.17":"73546639","1.3.6.1.4.1.57264.1.18":"https://github.com/franciscoparrao/surtgis/.github/workflows/python-release.yml@refs/tags/v1.8.1","1.3.6.1.4.1.57264.1.19":"1620b12ba41f28c41179bb527eda59f512ab8016","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/franciscoparrao/surtgis/actions/runs/42323859809/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}}],"formats":["CycloneDX"],"sbom_count":5,"has_attestation":true,"vulnerabilities":[{"id":"GHSA-36hh-v3qg-5jq4","aliases":["RUSTSEC-2026-0176"],"summary":"PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.23.5","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.23.5","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0194","aliases":[],"summary":"Quadratic run time when checking a start tag for duplicate attribute names","severity":"high","score":7.5,"package":"quick-xml","version":"0.39.2","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.39.2","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0194","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0195","aliases":[],"summary":"Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service","severity":"high","score":7.5,"package":"quick-xml","version":"0.39.2","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.39.2","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0195","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-25800","aliases":["GHSA-4w2j-m93h-cj5j","RUSTSEC-2026-0185"],"summary":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.15"],"url":"https://insights.sbomify.com/CVE-2026-25800/","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0340","aliases":["GHSA-3g6h-r5qx-f6hq"],"summary":"Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0340","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"CVE-2026-119375","aliases":["GHSA-72w2-rjgg-q729","RUSTSEC-2026-0459"],"summary":"`libsqlite3-sys` via C SQLite CVE-2026-119375","severity":"medium","score":6.8,"package":"libsqlite3-sys","version":"0.37.0","ecosystem":"crates.io","purl":"pkg:cargo/libsqlite3-sys@0.37.0","fixed":["0.39.0"],"url":"https://insights.sbomify.com/CVE-2026-119375/","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.23.5","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.23.5","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0020","aliases":["GHSA-pph8-gcv7-4qj5"],"summary":"Risk of buffer overflow in `PyString::from_object`","severity":"low","score":2.9,"package":"pyo3","version":"0.23.5","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.23.5","fixed":["0.24.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0020","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0221","aliases":[],"summary":"`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`","severity":"unknown","score":null,"package":"event-listener","version":"5.4.1","ecosystem":"crates.io","purl":"pkg:cargo/event-listener@5.4.1","fixed":["5.4.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0221","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0165","aliases":[],"summary":"i_tree allowed out-of-bounds access through safe public node accessors","severity":"unknown","score":null,"package":"i_tree","version":"0.8.3","ecosystem":"crates.io","purl":"pkg:cargo/i_tree@0.8.3","fixed":["0.10.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0165","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0253","aliases":[],"summary":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","severity":"unknown","score":null,"package":"lru","version":"0.16.4","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.16.4","fixed":["0.18.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0253","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2024-0436","aliases":[],"summary":"paste - no longer maintained","severity":"unknown","score":null,"package":"paste","version":"1.0.15","ecosystem":"crates.io","purl":"pkg:cargo/paste@1.0.15","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0436","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.10.0","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.10.0","fixed":["0.10.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.9.2","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.9.2","fixed":["0.9.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["surtgis-1.8.1-cp39-abi3-macosx_10_12_x86_64.whl","surtgis-1.8.1-cp39-abi3-macosx_11_0_arm64.whl","surtgis-1.8.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl","surtgis-1.8.1-cp39-abi3-musllinux_1_2_x86_64.whl","surtgis-1.8.1-cp39-abi3-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":5,"total_sboms":5,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":5,"medium":2,"low":1,"unknown":9}}}