RUSTSEC-2024-0342: Degraded secret zeroization capabilities

What to do

1. See which version you have: cargo tree -i vodozemac (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p vodozemac. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example vodozemac = "0.6.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set.

Impact

The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure.

Overall, we consider the impact of this issue to be low. Although cryptographic best practices recommend the clearing of sensitive information from memory once it's no longer needed, the inherent limitations of Rust regarding absolute zeroization reduce the practical severity of this lapse.

References

• Package: crates.io/crates/vodozemac
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0342.html
• Web: github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54db7ee39489d9

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for vodozemac

• VulnerabilityRUSTSEC-2024-0354 · 2024-07-17 Usage of non-constant time base64 decoder could lead to leakage of secret key material

Full security history of vodozemac