{"action":"Upgrade vodozemac to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0.0.0-0"}],"component":"vodozemac","cve_ids":["CVE-2024-40640"],"ecosystem":"crates.io","epss":0.00201,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-j8cm-g7r6-hfpq","id":"tcs_01M5KF988G4JSA6BAHEZK6096R","modified_at":"2026-10-12T18:00:07.418792131Z","published_at":"2024-07-17T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2024-0354","https://crates.io/crates/vodozemac","https://rustsec.org/advisories/RUSTSEC-2024-0354.html","https://github.com/matrix-org/vodozemac/commit/734b6c6948d4b2bdee3dd8b4efa591d93a61d272"],"severity":{"label":"low","score":2.9},"sources":[{"source":"osv","source_id":"RUSTSEC-2024-0354","url":"https://osv.dev/vulnerability/RUSTSEC-2024-0354"},{"source":"nvd","source_id":"CVE-2024-40640","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40640"}],"summary":"Usage of non-constant time base64 decoder could lead to leakage of secret key material"}