# SBOM for underthesea-core 3.3.2

> Underthesea Core

The Python package underthesea-core 3.3.2 ships 35 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)).

- Package URL (PURL): `pkg:pypi/underthesea-core@3.3.2`
- PyPI: https://pypi.org/project/underthesea-core/3.3.2/
- License: Apache-2.0
- Requires Python: \>=3.10
- Homepage: <https://github.com/undertheseanlp/underthesea/tree/main/extensions/underthesea_core>
- Repository: <https://github.com/undertheseanlp/underthesea/>

## SBOMs

### underthesea\_core-3.3.2-cp310-cp310-macosx\_10\_12\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/9cbe898b-ae3b-5fbb-9081-e067068a48e5/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp310-cp310-macosx\_11\_0\_arm64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/af0a3474-813b-52c8-9c2b-66e10d0404f8/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp310-cp310-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/b5be6603-f85c-57dc-abd3-b296a17ba708/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp310-cp310-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/7abba9c5-f168-5854-84ba-d2ae69946732/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp310-cp310-musllinux\_1\_2\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/87a7a3d1-0508-50a7-a2b1-d843cc51e449/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp310-cp310-musllinux\_1\_2\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/9441a283-70b2-5e50-81d7-7cbdf668417f/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp310-cp310-win\_amd64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/921e4318-9419-5510-b212-4f82b126e1ac/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-macosx\_10\_12\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/b66603ba-5368-5bdd-b570-aaa16d0db1f2/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-macosx\_11\_0\_arm64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/bbc0d2ec-1935-5afd-a21f-31550df52c8d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/9ae1bd45-5f14-50a7-bb2d-25af146e0ace/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/de6963cf-265d-5368-968e-839e3cd9b1f6/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-musllinux\_1\_2\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/382819b3-840c-5527-bc73-748681ecb3df/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-musllinux\_1\_2\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/57c9e46f-6453-584d-9948-5cda03cedb85/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp311-cp311-win\_amd64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/abf1d908-6e5d-5759-9d4a-0460aa916510/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-macosx\_10\_12\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/3f40c3a8-2a8e-5c59-9062-8d55b4788b08/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-macosx\_11\_0\_arm64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/2d9ad705-17fd-5988-9173-31031e44d06d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/70c21e00-48ef-5261-a071-1e269a8b9135/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/4ed3935d-c26e-5e0e-8fab-b86fe79061c7/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-musllinux\_1\_2\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/a2506fb2-cc5d-5eb0-b6f5-cb827790d40b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-musllinux\_1\_2\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/85eb5c0e-222a-51c1-8786-09cfde30ae8e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp312-cp312-win\_amd64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/d8b96a1f-1199-5e78-a947-b49df8a3086c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-macosx\_10\_12\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/6f4fec50-43ad-590e-acfa-10d1563e8a5a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-macosx\_11\_0\_arm64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/d6e8ab30-ce63-5f56-bfa8-29c13221b86a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/7422f89b-e939-5d26-a750-3cddb7150c69/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/afaa577b-784d-58f4-9fee-004d1e231094/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-musllinux\_1\_2\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/725a80b8-2fa0-56ec-9892-4a8b9aeb2825/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-musllinux\_1\_2\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/258ac304-0bee-506c-bc59-9a854c0545ee/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp313-cp313-win\_amd64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/1b656aee-dbe5-5ed5-ae6f-ebad3a0fd685/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-macosx\_10\_12\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/c2e9c88c-9b6c-5f3b-b31c-3ec6ef0fecb1/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-macosx\_11\_0\_arm64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/d76cf625-a705-5a97-aa8f-dbc619ef8334/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/4d4aaf29-7920-563f-983f-bebdeeed9873/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/2f7dfca4-fa04-5548-b8d1-9c0dca26f40c/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-musllinux\_1\_2\_aarch64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/644868d2-1b57-5df8-b505-af6ae25b7e7a/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-musllinux\_1\_2\_x86\_64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/749e5a0b-3fea-5559-ac49-41b0d2f675fb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

### underthesea\_core-3.3.2-cp314-cp314-win\_amd64.whl

- [underthesea\_core-3.3.2.dist-info/sboms/underthesea\_core.cyclonedx.json](https://pypi.sbomify.com/artifact/e8bc25b1-bb9c-5daf-a8a3-d91d7cb09004/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 5 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.25.1 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.25.1 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.102 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2025-0141](https://osv.dev/vulnerability/RUSTSEC-2025-0141) | unknown | bincode 1.3.3 (crates.io) | none listed | Bincode is unmaintained |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/underthesea-core@3.3.2
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/underthesea-core/3.3.2.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/underthesea-core/3.3.2