# SBOM for tracecov-community 0.26.0 > Schema-level API coverage. Install 'tracecov' for the full package. The Python package tracecov-community 0.26.0 ships 16 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). - Package URL (PURL): `pkg:pypi/tracecov-community@0.26.0` - PyPI: https://pypi.org/project/tracecov-community/0.26.0/ - Requires Python: \>=3.10 - Documentation: - Homepage: ## SBOMs ### tracecov\_community-0.26.0-cp310-abi3-macosx\_10\_12\_universal2.macosx\_10\_12\_x86\_64.macosx\_11\_0\_arm64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/0a3ebcd1-978c-5577-8eec-ae30d83b15f2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp310-abi3-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ec75c903-8c06-59c8-9173-db8798ebb7e2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp310-abi3-manylinux\_2\_28\_aarch64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/44c16380-c012-56bb-a259-900e0fae81f3/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp310-abi3-win\_amd64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/6055611a-21f9-5cf3-b9ab-08fa251690b8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp314-cp314t-macosx\_11\_0\_arm64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/4c6a7d5b-6649-5efd-9b2f-ea20284757bf/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp314-cp314t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/b58a6de4-0687-549c-8e92-1377718fa883/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp314-cp314t-manylinux\_2\_28\_aarch64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/58b22a31-6275-547c-89f1-fcd11f9108a0/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp314-cp314t-musllinux\_1\_2\_aarch64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/49ecea44-b434-5d1a-b9be-0e174defa242/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/42b838b5-947c-57d5-8fa2-d5cdd5ce2887/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp314-cp314t-win\_amd64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/5df17fc4-7705-5a2d-973d-90f250af841a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp315-cp315t-macosx\_11\_0\_arm64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/5464a26e-592d-5d42-8372-4dbde187d06f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp315-cp315t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/f4bdb07c-c550-5d5b-bc03-7b4298ef8d28/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp315-cp315t-manylinux\_2\_28\_aarch64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/d2353bdd-3777-59c5-afb4-badd5da4d116/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp315-cp315t-musllinux\_1\_2\_aarch64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/5c9e54b8-acda-5f5f-bbbe-4eb83eda2895/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp315-cp315t-musllinux\_1\_2\_x86\_64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/8f7542c2-b845-5b57-9754-fc785222a378/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ### tracecov\_community-0.26.0-cp315-cp315t-win\_amd64.whl - [tracecov\_community-0.26.0.dist-info/sboms/tracecov-py.cyclonedx.json](https://pypi.sbomify.com/artifact/ee386dda-a169-577e-a048-844aaab91e89/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 7 known vulnerabilities ## Known vulnerabilities Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10. | Vulnerability | Severity | Component | Fixed in | Summary | |---|---|---|---|---| | [CVE-2019-25009](https://insights.sbomify.com/CVE-2019-25009/) | critical (9.8) | http 0.1.0 (crates.io) | 0.1.20 | HeaderMap::Drain API is unsound | | [CVE-2019-25008](https://insights.sbomify.com/CVE-2019-25008/) | high (7.5) | http 0.1.0 (crates.io) | 0.1.20 | Integer Overflow in HeaderMap::reserve() can cause Denial of Service | | [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.40.1 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names | | [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.40.1 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service | | [RUSTSEC-2023-0050](https://osv.dev/vulnerability/RUSTSEC-2023-0050) | unknown | multipart 0.1.0 (crates.io) | none listed | multipart is Unmaintained | | [RUSTSEC-2026-0173](https://osv.dev/vulnerability/RUSTSEC-2026-0173) | unknown | proc-macro-error2 2.0.1 (crates.io) | none listed | proc-macro-error2 is unmaintained | | [RUSTSEC-2024-0449](https://osv.dev/vulnerability/RUSTSEC-2024-0449) | unknown | unsafe-libyaml 0.2.11 (crates.io) | none listed | unsafe-libyaml is unmaintained | ## Fetch it over TEA This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client: ``` pip install libtea python -m libtea https://pypi.sbomify.com pkg:pypi/tracecov-community@0.26.0 ``` Machine-readable copy of this page: https://pypi.sbomify.com/package/tracecov-community/0.26.0.json --- From pypi-tea by sbomify: https://pypi.sbomify.com/package/tracecov-community/0.26.0