GitHub Advisoryadvisory · crates.io

GHSA-253q-9q78-63x4 Clatter has a PSK Validity Rule Violation issue

HIGH Published 2026-01-28 Modified 2026-01-28 Official page ↗
Aliases
CVE-2026-24785
Ecosystem
crates.io
Packages
clatter
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-327
Reviewed
2026-01-28

Affected packages

• crates.io clatter: < 2.2.0 → fixed in 2.2.0

Description

Impact Protocol compliance vulnerability. The library allowed post-quantum handshake patterns that violated the PSK validity rule (Noise Protocol Framework Section 9.3). This could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, weakening security guarantees and potentially allowing catastrophic key reuse. Affected default patterns include `noise_pqkk_psk0`, `noise_pqkn_psk0`, `noise_pqnk_psk0`, `noise_pqnn_psk0`, and some hybrid variants. Users of these patterns may have been using handshakes that do not meet the intended security properties. Patches The issue is fully patched and released in Clatter v2.2.0. The fixed version includes runtime checks to detect offending handshake patterns. Workarounds Avoid using offending `*_psk0` variants of post-quantum patterns. Review custom handshake patterns carefully. Resources • PSK validity rule

Related

Alias · CVE (1)

  • CVE-2026-24785 Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References