Vulnerability RUSTSEC-2026-0445
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 hours ago
November 06, 2026 at 12:00 PM UTC
Degraded secret zeroization capabilities
>=0.11.0 <0.11.2
>=0.11.0 <0.11.2
Summary
Degraded secret zeroization capabilities
Details
Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.
Impact
The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
8 hours ago
Degraded secret zeroization capabilities
>=0.0.0-0 <0.11.2 RUSTSEC-2026-0451
>=0.0.0-0 <0.11.2 RUSTSEC-2026-0451
Low Risk
2 years ago
vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material
<0.7.0 GHSA-j8cm-g7r6-hfpq
<0.7.0 GHSA-j8cm-g7r6-hfpq
Unknown
2 years ago
Usage of non-constant time base64 decoder could lead to leakage of secret key material
>=0.0.0-0 <0.7.0 RUSTSEC-2024-0354
>=0.0.0-0 <0.7.0 RUSTSEC-2024-0354
Low Risk
2 years ago
vodozemac has degraded secret zeroization capabilities
>=0.5.0 <0.6.0 GHSA-c3hm-hxwf-g5c6
>=0.5.0 <0.6.0 GHSA-c3hm-hxwf-g5c6
Unknown
2 years ago
Degraded secret zeroization capabilities
>=0.5.0 <0.6.0 RUSTSEC-2024-0342
>=0.5.0 <0.6.0 RUSTSEC-2024-0342
Impacted packages
Timeline
Published
8 hours ago
November 06, 2026 at 12:00 PM UTC
Last Modified
5 hours ago
November 06, 2026 at 02:45 PM UTC