Vodozemac: Panic when decoding malformed Ed25519 keys from Base64
Affects vodozemacSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.11.2
Data as of 12 Nov 2026, 15:47 UTC
What to do
Upgrade vodozemac to 0.11.2.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iovodozemacpkg:cargo/vodozemacOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to vodozemac version 0.11.2 or later, where the issue is fixed. The patched version correctly returns an error instead of panicking on malformed input.
Description
Versions 0.11.1 and earlier of vodozemac contain a vulnerability where malformed Ed25519 keys decoded from Base64 cause a panic instead of returning an error. This occurs when the decoded input is 31 or 33 bytes instead of the expected 32 bytes. An attacker able to supply such keys can crash applications using vodozemac, resulting in denial of service. No key disclosure or signature forgery is possible. The issue is fixed in version 0.11.2.