PT-2026-5038 · Clatter · Clatter

Jmlepisto · Published 2026-01-27 · Updated 2026-01-28 · CVE-2026-24785

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Clatter versions prior to 2.2.0

Description Clatter, a Rust implementation of the Noise protocol framework with post-quantum support, contains a protocol compliance issue. The library permitted post-quantum handshake patterns that did not adhere to the PSK validity rule as defined in the Noise Protocol Framework Section 9.3. This could enable the use of PSK-derived keys for encryption without sufficient randomization through self-chosen ephemeral randomness, potentially leading to catastrophic key reuse and weakened security. Affected default patterns include noise pqkk psk0, noise pqkn psk0, noise pqnk psk0, and noise pqnn psk0, as well as some hybrid variants.

Recommendations Update to Clatter version 2.2.0 or later. Avoid using the * psk0 variants of post-quantum patterns. Carefully review custom handshake patterns.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2026-24785

GHSA-253Q-9Q78-63X4

Affected Products

Clatter

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24785.json · Exploit
• https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71 · Patch
• https://github.com/jmlepisto/clatter/security/advisories/GHSA-253q-9q78-63x4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-253q-9q78-63x4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24785 · Security Note
• https://github.com/jmlepisto/clatter · Note
• https://twitter.com/_cvereports/status/2016552057033937293 · Twitter Post
• https://t.me/cveNotify/150060 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016330491968844024 · Twitter Post
• https://noiseprotocol.org/noise.html#validity-rule · Note
• https://twitter.com/CVEnew/status/2016299196588986645 · Twitter Post