GHSA-mxcm-mrw6-c446 json
Degraded secret zeroization capabilities
published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also RUSTSEC-2026-0445
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.
## Impact
The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.
Patch / fix
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | vodozemac | >=0.11.0, <0.11.2 |
0.11.2 |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.