GHSA-mxcm-mrw6-c446
Degraded secret zeroization capabilities
Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.
Impact
The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.
What each source reports
OSVRUSTSEC-2026-0445No score
Degraded secret zeroization capabilities
Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.
Impact
The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.
- Record
RUSTSEC-2026-0445- Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vodozemaccrates.io | 0.11.0 up to 0.11.2 | 0.11.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mxcm-mrw6-c446 is a vulnerability with no CVSS score yet in vodozemac, published November 6, 2026. No source lists public exploit code. Fixed in vodozemac 0.11.2.