RUSTSEC-2026-0451

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0451

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0451.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0451

Aliases

GHSA-v27v-f96q-qhjq

Published

2026-11-06T12:00:00Z

Modified

2026-11-06T15:45:02Z

Summary

Degraded secret zeroization capabilities

Details

In version 0.11.1 and earlier of vodozemac, the Olm root key ratchet did not zeroize its HKDF output after use. Each ratchet step left a copy of the new root key and chain key in freed heap memory.

Impact

An attacker who can read the process's memory, for example through a separate memory-disclosure bug, a core dump, or swapped-out pages, may recover root keys and chain keys from earlier ratchet steps. A leaked chain key allows decrypting the messages in that chain, weakening Olm's forward secrecy for affected sessions.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / vodozemac

Package

Name: vodozemac; View open source insights on deps.dev
Purl: pkg:cargo/vodozemac

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.11.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}