Vodozemac: Degraded secret zeroization capabilities
Affects vodozemacSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.11.2
Data as of 6 Nov 2026, 16:48 UTC
What to do
Upgrade vodozemac to 0.11.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iovodozemacpkg:cargo/vodozemacOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to vodozemac version 0.11.2 or later, where the Olm root key ratchet properly zeroizes HKDF output after use, eliminating residual key material in freed memory. No other mitigations are indicated.
Description
Versions 0.11.1 and earlier of vodozemac have a vulnerability where the Olm root key ratchet does not zeroize HKDF output after use. This results in copies of root and chain keys remaining in freed heap memory. An attacker with memory access could recover these keys, compromising forward secrecy for affected sessions.