CVE-2026-24785

Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Versiosn prior to2.2.0 have a protocol compliance vulnerability. The library allowed post-quantum handshake patterns that violated the PSK validity rule (Noise Protocol Framework Section 9.3). This could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, weakening security guarantees and potentially allowing catastrophic key reuse. Affected default patterns include `noise_pqkk_psk0`, `noise_pqkn_psk0`, `noise_pqnk_psk0`, `noise_pqnn_psk0``, and some hybrid variants. Users of these patterns may have been using handshakes that do not meet the intended security properties. The issue is fully patched and released in Clatter v2.2.0. The fixed version includes runtime checks to detect offending handshake patterns. As a workaround, avoid using offending `*_psk0` variants of post-quantum patterns. Review custom handshake patterns carefully.

• CWE-327

• https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71Patch
• https://github.com/jmlepisto/clatter/security/advisories/GHSA-253q-9q78-63x4Mitigation, Vendor Advisory
• https://noiseprotocol.org/noise.html#validity-ruleTechnical Description

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24779vLLM is an inference and serving engine for large language m…7.1
• CVE-2026-24780AutoGPT is a platform that allows users to create, deploy, a…8.8
• CVE-2026-24781vm2 is an open source vm/sandbox for Node.js. Prior to versi…9.8
• CVE-2026-24782Kiteworks is a private data network (PDN). Prior to version …8.8
• CVE-2026-24783soroban-fixed-point-math is a fixed-point math library for S…7.5
• CVE-2026-24784DNN (formerly DotNetNuke) is an open-source web content mana…4.8
• CVE-2026-24788RaspAP raspap-webgui versions prior to 3.3.6 contain an OS c…8.8
• CVE-2026-24789An unprotected API endpoint allows an attacker to remotely c…9.8
• CVE-2026-2479The Responsive Lightbox & Gallery plugin for WordPress is vu…5
• CVE-2026-24790The underlying PLC of the device can be remotely influenced,…8.2
• CVE-2026-24792in OpenHarmony v6.0 and prior versions allow a remote attack…8.1
• CVE-2026-24793Out-of-bounds Write, Buffer Copy without Checking Size of In…9.8