Versions 0.11.1 and earlier of vodozemac contain a vulnerability where malformed Ed25519 keys decoded from Base64 cause a panic instead of returning an error. This occurs when the decoded input is 31 or 33 bytes instead of the expected 32 bytes. An attacker able to supply such keys can crash applications using vodozemac, resulting in denial of service. No key disclosure or signature forgery is possible. The issue is fixed in version 0.11.2.