Vulnerability RUSTSEC-2026-0510
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 days ago
November 11, 2026 at 12:00 PM UTC
Panic when decoding malformed Ed25519 keys from Base64
>=0.0.0-0 <0.11.2
>=0.0.0-0 <0.11.2
Summary
Panic when decoding malformed Ed25519 keys from Base64
Details
In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::from_base64() and Ed25519SecretKey::from_base64() panic on malformed input instead of returning an error, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes. An attacker who can supply a key to an application using vodozemac can crash it.
Impact
Ed25519 public keys are routinely received from other Matrix users and servers, so a malicious party can publish a crafted key that crashes clients parsing it.
The impact is limited to denial of service; no key disclosure or signature forgery is possible.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
7 days ago
Degraded secret zeroization capabilities
>=0.11.0 <0.11.2 RUSTSEC-2026-0445
>=0.11.0 <0.11.2 RUSTSEC-2026-0445
Unknown
7 days ago
Degraded secret zeroization capabilities
>=0.0.0-0 <0.11.2 RUSTSEC-2026-0451
>=0.0.0-0 <0.11.2 RUSTSEC-2026-0451
Low Risk
2 years ago
vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material
<0.7.0 GHSA-j8cm-g7r6-hfpq
<0.7.0 GHSA-j8cm-g7r6-hfpq
Unknown
2 years ago
Usage of non-constant time base64 decoder could lead to leakage of secret key material
>=0.0.0-0 <0.7.0 RUSTSEC-2024-0354
>=0.0.0-0 <0.7.0 RUSTSEC-2024-0354
Low Risk
2 years ago
vodozemac has degraded secret zeroization capabilities
>=0.5.0 <0.6.0 GHSA-c3hm-hxwf-g5c6
>=0.5.0 <0.6.0 GHSA-c3hm-hxwf-g5c6
Impacted packages
Timeline
Published
2 days ago
November 11, 2026 at 12:00 PM UTC
Fixed (0.11.2)
8 days ago
November 05, 2026 at 02:04 PM UTC
Last Modified
1 day ago
November 12, 2026 at 02:30 PM UTC