Vulnerability RUSTSEC-2026-0451
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 hours ago
November 06, 2026 at 12:00 PM UTC
Degraded secret zeroization capabilities
>=0.0.0-0 <0.11.2
>=0.0.0-0 <0.11.2
Summary
Degraded secret zeroization capabilities
Details
In version 0.11.1 and earlier of vodozemac, the Olm root key ratchet did not zeroize its HKDF output after use. Each ratchet step left a copy of the new root key and chain key in freed heap memory.
Impact
An attacker who can read the process's memory, for example through a separate memory-disclosure bug, a core dump, or swapped-out pages, may recover root keys and chain keys from earlier ratchet steps. A leaked chain key allows decrypting the messages in that chain, weakening Olm's forward secrecy for affected sessions.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
8 hours ago
Degraded secret zeroization capabilities
>=0.11.0 <0.11.2 RUSTSEC-2026-0445
>=0.11.0 <0.11.2 RUSTSEC-2026-0445
Low Risk
2 years ago
vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material
<0.7.0 GHSA-j8cm-g7r6-hfpq
<0.7.0 GHSA-j8cm-g7r6-hfpq
Unknown
2 years ago
Usage of non-constant time base64 decoder could lead to leakage of secret key material
>=0.0.0-0 <0.7.0 RUSTSEC-2024-0354
>=0.0.0-0 <0.7.0 RUSTSEC-2024-0354
Low Risk
2 years ago
vodozemac has degraded secret zeroization capabilities
>=0.5.0 <0.6.0 GHSA-c3hm-hxwf-g5c6
>=0.5.0 <0.6.0 GHSA-c3hm-hxwf-g5c6
Unknown
2 years ago
Degraded secret zeroization capabilities
>=0.5.0 <0.6.0 RUSTSEC-2024-0342
>=0.5.0 <0.6.0 RUSTSEC-2024-0342
Impacted packages
Timeline
Published
8 hours ago
November 06, 2026 at 12:00 PM UTC
Last Modified
4 hours ago
November 06, 2026 at 03:45 PM UTC