Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 6 November 2026.

Which products and versions are affected?

vodozemac (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.11.2; Matrix.org Vodozemac 0.11.1 and earlier.

Is there a fix for This vulnerability?

Yes. vodozemac (crates.io): upgrade to 0.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Check whether you run vodozemac (crates.io) or Matrix.org Vodozemac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

vodozemac Olm key ratchet memory exposure

Severity: info · Published 2026-11-06

vodozemac is a Rust library that implements encrypted messaging protocols including the Olm ratchet, used to maintain forward secrecy in encrypted communications. A flaw in versions 0.11.1 and earlier leaves cryptographic keys (root keys and chain keys) unzeroized in freed memory after each ratchet step, potentially allowing attackers with memory-read access to recover these keys and decrypt previously secure messages.

Technologies: vodozemac (crates.io). Vendors: crates.io, Matrix.org.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 6 November 2026.
Which products and versions are affected?: vodozemac (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.11.2; Matrix.org Vodozemac 0.11.1 and earlier.
Is there a fix for This vulnerability?: Yes. vodozemac (crates.io): upgrade to 0.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected?: Check whether you run vodozemac (crates.io) or Matrix.org Vodozemac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vodozemac (crates.io): upgrade to 0.11.2 or later
```
cargo update -p vodozemac
```

Technical details

The Olm root key ratchet in vodozemac fails to zeroize HKDF output after use, leaving copies of root and chain keys in freed heap memory after each ratchet step. An attacker with memory-disclosure capability (via separate vulnerability, core dump, or memory pages) can recover keys from earlier ratchet steps, compromising forward secrecy by enabling decryption of messages encrypted with recovered chain keys. The fix is available in version 0.11.2.

Affected products

matrix-org vodozemac 0.11.1 and earlier

Identifiers

GHSA-v27v-f96q-qhjq
RUSTSEC-2026-0451

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.