{"id":"RUSTSEC-2026-0445","summary":"Degraded secret zeroization capabilities","details":"Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization\ncapabilities, due to changes in third-party cryptographic dependencies\n(chacha-20poly1305, sha2, hmac), which moved secret zeroization capabilities\nbehind a feature flag while vodozemac disabled the default feature set.\n\n## Impact\n\nThe degraded zeroization capabilities could result in the production of more\nmemory copies of encryption secrets and secrets could linger in memory longer\nthan necessary. This marginally increases the risk of sensitive data exposure.","aliases":["GHSA-mxcm-mrw6-c446"],"modified":"2026-11-06T14:45:02.847323520Z","published":"2026-11-06T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/vodozemac"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0445.html"},{"type":"WEB","url":"https://github.com/matrix-org/vodozemac/pull/448"}],"affected":[{"package":{"name":"vodozemac","ecosystem":"crates.io","purl":"pkg:cargo/vodozemac"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.11.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":[],"arch":[]}},"database_specific":{"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0445.json","categories":["memory-exposure"]}}],"schema_version":"1.9.2"}