{"action":"Upgrade vodozemac to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"vodozemac","cve_ids":["CVE-2024-40640"],"ecosystem":"crates.io","epss":0.00201,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-j8cm-g7r6-hfpq","id":"tcs_01M5KF0YQF7V3ETZVDGGCJBAG5","modified_at":"2026-09-10T03:50:16.794237652Z","published_at":"2024-07-17T18:30:55Z","references":["https://osv.dev/vulnerability/GHSA-j8cm-g7r6-hfpq","https://github.com/matrix-org/vodozemac/security/advisories/GHSA-j8cm-g7r6-hfpq","https://nvd.nist.gov/vuln/detail/CVE-2024-40640","https://github.com/matrix-org/vodozemac/commit/734b6c6948d4b2bdee3dd8b4efa591d93a61d272","https://github.com/matrix-org/vodozemac/commit/77765dace11266ef9523301624a01265c6e0f790","https://arxiv.org/abs/2108.04600","https://github.com/matrix-org/vodozemac","https://rustsec.org/advisories/RUSTSEC-2024-0354.html"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-j8cm-g7r6-hfpq","url":"https://osv.dev/vulnerability/GHSA-j8cm-g7r6-hfpq"}],"summary":"vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material"}