Skip to content
Fencer Intel
no cvss —

GHSA-mxcm-mrw6-c446 json

Degraded secret zeroization capabilities

published 4d ago modified 4d ago also RUSTSEC-2026-0445

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.

## Impact

The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.

Patch / fix

  • crates.io vodozemac 0.11.2

Is GHSA-mxcm-mrw6-c446 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io vodozemac
>=0.11.0, <0.11.2
0.11.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.