# vodozemac degraded secret zeroization in cryptographic libraries

Source: https://junglewise.ai/threats/rustsec-2026-0445-degraded-secret-zeroization-capabilities-1022d5f6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-06

vodozemac is a Rust library used for encryption in the Matrix protocol. Versions 0.11.0 and 0.11.1 have reduced protection against memory attacks because they disabled security features in their cryptographic dependencies, allowing encryption secrets to persist in RAM longer than intended and creating additional copies in memory. This increases the risk of sensitive keys being recovered through memory-based attacks.

Technologies: [vodozemac (crates.io)](https://junglewise.ai/threats/technologies/vodozemac). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Matrix](https://junglewise.ai/threats/vendors/matrix).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** vodozemac (crates.io) SEMVER:introduced=0.11.0,fixed=0.11.2; Matrix Vodozemac 0.11.0, 0.11.1.

**Is there a fix for This vulnerability?** Yes. vodozemac (crates.io): upgrade to 0.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run vodozemac (crates.io) or Matrix Vodozemac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vodozemac (crates.io): upgrade to 0.11.2 or later

  ```sh
  cargo update -p vodozemac
  ```


## Technical details

Versions 0.11.0 and 0.11.1 of vodozemac disabled default features in upstream cryptographic dependencies (chacha-20poly1305, sha2, hmac) whose secret zeroization capabilities were moved behind feature flags, resulting in degraded zeroization of encryption secrets. The vulnerability allows secrets to linger in memory and creates additional copies that are not properly cleared. This is a memory-exposure class issue affecting all users of these versions with no privilege escalation or network interaction required.

## Affected products

- Matrix vodozemac 0.11.0, 0.11.1

## Identifiers

- GHSA-mxcm-mrw6-c446
- RUSTSEC-2026-0445

## Timeline

- 2026-11-06: disclosed
- 2026-11-06: patched

## References

- [https://crates.io/crates/vodozemac](https://crates.io/crates/vodozemac)
- [https://rustsec.org/advisories/RUSTSEC-2026-0445.html](https://rustsec.org/advisories/RUSTSEC-2026-0445.html)

## Related threats

- [vodozemac Olm key ratchet memory exposure](https://junglewise.ai/threats/rustsec-2026-0451-degraded-secret-zeroization-capabilities-e41f4f5c)
- [RUSTSEC-2024-0354 - Usage of non-constant time base64 decoder could lead to leakage of secret key material](https://junglewise.ai/threats/cve-2024-40640-vodozemac-s-usage-of-non-constant-time-base64-decoder-could-lead)
- [RUSTSEC-2024-0342 - Degraded secret zeroization capabilities](https://junglewise.ai/threats/cve-2024-34063-vodozemac-has-degraded-secret-zeroization-capabilities)