{"id":"GHSA-253q-9q78-63x4","summary":"Clatter has a PSK Validity Rule Violation issue","details":"### Impact\n\nProtocol compliance vulnerability. The library allowed post-quantum handshake patterns that violated the PSK validity rule (Noise Protocol Framework Section 9.3). This could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, weakening security guarantees and potentially allowing catastrophic key reuse.\n\nAffected default patterns include `noise_pqkk_psk0`, `noise_pqkn_psk0`, `noise_pqnk_psk0`, `noise_pqnn_psk0`, and some hybrid variants. Users of these patterns may have been using handshakes that do not meet the intended security properties.\n\n### Patches\n\nThe issue is fully patched and released in Clatter v2.2.0. The fixed version includes runtime checks to detect offending handshake patterns.\n\n### Workarounds\n\nAvoid using offending `*_psk0` variants of post-quantum patterns. Review custom handshake patterns carefully.\n\n### Resources\n\n* [PSK validity rule](https://noiseprotocol.org/noise.html#validity-rule)","aliases":["CVE-2026-24785"],"modified":"2026-02-03T03:06:28.504290Z","published":"2026-01-28T16:21:03Z","database_specific":{"nvd_published_at":"2026-01-28T00:15:50Z","cwe_ids":["CWE-327"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-01-28T16:21:03Z"},"references":[{"type":"WEB","url":"https://github.com/jmlepisto/clatter/security/advisories/GHSA-253q-9q78-63x4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24785"},{"type":"WEB","url":"https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71"},{"type":"PACKAGE","url":"https://github.com/jmlepisto/clatter"},{"type":"WEB","url":"https://noiseprotocol.org/noise.html#validity-rule"}],"affected":[{"package":{"name":"clatter","ecosystem":"crates.io","purl":"pkg:cargo/clatter"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-253q-9q78-63x4/GHSA-253q-9q78-63x4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"}]}