RUSTSEC-2026-0510: Panic when decoding malformed Ed25519 keys from Base64
In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::frombase64() and Ed25519SecretKey::frombase64() panic on malformed input instead of returning an error, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes. An attacker who can supply a key to an application using vodozemac can crash it.
Impact
Ed25519 public keys are routinely received from other Matrix users and servers, so a malicious party can publish a crafted key that crashes clients parsing it.
The impact is limited to denial of service; no key disclosure or signature forgery is possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/vodozemacto a version that resolves this vulnerability.Fixed in 0.11.2
Event History
Frequently Asked Questions
Who is realistically exposed to this denial-of-service issue?
Applications using affected vodozemac versions that parse Ed25519 keys supplied by untrusted parties are exposed. Matrix clients are a notable case because they routinely receive public keys from other Matrix users and servers.
What input is needed to trigger the panic?
An attacker must cause the application to call Ed25519PublicKey::from_base64() or Ed25519SecretKey::from_base64() with malformed Base64 input that decodes to exactly 31 or 33 bytes, rather than the required 32 bytes.
Does successful exploitation expose keys or allow signature forgery?
No. The stated impact is limited to crashing the application; it does not enable key disclosure or signature forgery.