GHSA-v27v-f96q-qhjq
Degraded secret zeroization capabilities
GHSA-v27v-f96q-qhjq is a vulnerability with no CVSS score yet in vodozemac, published November 6, 2026. No source lists public exploit code. Fixed in vodozemac 0.11.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.11.2vodozemac
Description
In version 0.11.1 and earlier of vodozemac, the Olm root key ratchet did not zeroize its HKDF output after use. Each ratchet step left a copy of the new root key and chain key in freed heap memory.
Impact
An attacker who can read the process's memory, for example through a separate memory-disclosure bug, a core dump, or swapped-out pages, may recover root keys and chain keys from earlier ratchet steps. A leaked chain key allows decrypting the messages in that chain, weakening Olm's forward secrecy for affected sessions.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vodozemaccrates.io | 0.0.0-0 up to 0.11.2 | 0.11.2 |
What each source reports
OSVRUSTSEC-2026-0451No score
Degraded secret zeroization capabilities
In version 0.11.1 and earlier of vodozemac, the Olm root key ratchet did not zeroize its HKDF output after use. Each ratchet step left a copy of the new root key and chain key in freed heap memory.
Impact
An attacker who can read the process's memory, for example through a separate memory-disclosure bug, a core dump, or swapped-out pages, may recover root keys and chain keys from earlier ratchet steps. A leaked chain key allows decrypting the messages in that chain, weakening Olm's forward secrecy for affected sessions.
- Record
RUSTSEC-2026-0451- Updated
- 2026-11-06
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.