Software Passport · public repository

lambdastackio/tokio-http2

Observed by SPR on 2026-09-19 at commit fad8751ada3568d8cf4890d6f39ab3ee7d7c7301 (master). Source: github.com/lambdastackio/tokio-http2.

SBOM components129
Open findings124
Critical / high1 / 3
Evidence items133

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 124)

SeverityFindingComponentFixed in
CRITICALGHSA-75w2-qv55-x7fvopenssl@0.9.6
HIGHGHSA-v5mp-jgw5-2x6jtoml@0.2.1
HIGHGHSA-82x6-q7mm-w9cftoml@0.2.1
HIGHGHSA-wrvr-8mpx-r7ppmime@0.2.2
MEDIUMLicense not observedws2_32-sys
MEDIUMLicense not observedwinapi-build
MEDIUMLicense not observedwinapi
MEDIUMLicense not observedvoid
MEDIUMLicense not observedvec_map
MEDIUMLicense not observedutf8-ranges
MEDIUMLicense not observeduser32-sys
MEDIUMLicense not observedurl
MEDIUMLicense not observedunreachable
MEDIUMLicense not observedunix_socket
MEDIUMLicense not observedunicode-width
MEDIUMLicense not observedunicode-segmentation
MEDIUMLicense not observedunicode-normalization
MEDIUMLicense not observedunicode-bidi
MEDIUMLicense not observedunicase
MEDIUMLicense not observedtoml
MEDIUMLicense not observedtokio-tls
MEDIUMLicense not observedtokio-service
MEDIUMLicense not observedtokio-proto
MEDIUMLicense not observedtokio-core
MEDIUMLicense not observedtime

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy