GHSA-v27v-f96q-qhjq: Degraded secret zeroization capabilities

Q: Who can realistically exploit this issue?

Exploitation requires an attacker to read the affected process's memory, such as through a separate memory-disclosure vulnerability, a core dump, or swapped-out memory pages. It is not described as remotely exploitable on its own.

Q: What cryptographic material could be exposed if memory is obtained?

Freed heap memory may retain copies of root keys and chain keys from earlier Olm root key ratchet steps. A recovered chain key can decrypt messages in that chain, reducing forward secrecy for affected sessions.

Q: How can I determine whether an application is affected?

Check whether the application depends on vodozemac version 0.11.1 or earlier. The issue affects the Olm root key ratchet in those versions.

Published Nov 6, 2026

Updated

In version 0.11.1 and earlier of vodozemac, the Olm root key ratchet did not zeroize its HKDF output after use. Each ratchet step left a copy of the new root key and chain key in freed heap memory.

Impact

An attacker who can read the process's memory, for example through a separate memory-disclosure bug, a core dump, or swapped-out pages, may recover root keys and chain keys from earlier ratchet steps. A leaked chain key allows decrypting the messages in that chain, weakening Olm's forward secrecy for affected sessions.

Affected Software

1 affected componentFixes available

rust/vodozemac>=0.0.0-0<0.11.2

0.11.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/vodozemac to a version that resolves this vulnerability.
Fixed in 0.11.2

Event History

Nov 6, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

Who can realistically exploit this issue?

Exploitation requires an attacker to read the affected process's memory, such as through a separate memory-disclosure vulnerability, a core dump, or swapped-out memory pages. It is not described as remotely exploitable on its own.

What cryptographic material could be exposed if memory is obtained?

Freed heap memory may retain copies of root keys and chain keys from earlier Olm root key ratchet steps. A recovered chain key can decrypt messages in that chain, reducing forward secrecy for affected sessions.

How can I determine whether an application is affected?

Check whether the application depends on vodozemac version 0.11.1 or earlier. The issue affects the Olm root key ratchet in those versions.

GHSA-v27v-f96q-qhjq: Degraded secret zeroization capabilities

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can realistically exploit this issue?

What cryptographic material could be exposed if memory is obtained?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically exploit this issue?

What cryptographic material could be exposed if memory is obtained?

How can I determine whether an application is affected?