GHSA-mxcm-mrw6-c446: Degraded secret zeroization capabilities
Published Nov 6, 2026
·Updated
Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.
Impact
The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.
Affected Software
1 affected componentFixes available
rust/vodozemac>=0.11.0<0.11.2
0.11.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/vodozemacto a version that resolves this vulnerability.Fixed in 0.11.2
Event History
Nov 6, 2026
Advisory Published
via OSV·12:00 PM
Data Sourced
via OSV·12:00 PM
DescriptionAffected Software