CVE-2026-24785: Jmlepisto Clatter Protocol Violation

CVE-2026-24785 Overview

CVE-2026-24785 is a cryptographic protocol compliance vulnerability in Clatter, a no_std compatible pure Rust implementation of the Noise protocol framework with post-quantum support. Versions prior to 2.2.0 permit post-quantum handshake patterns that violate the PSK validity rule defined in Section 9.3 of the Noise Protocol Framework. The flaw allows pre-shared key (PSK) derived keys to be used for encryption without proper randomization from self-chosen ephemeral randomness. This weakens the intended security guarantees and can result in catastrophic key reuse across sessions.

Critical Impact
Affected handshake patterns produce ciphertexts that do not meet Noise protocol security properties, potentially exposing confidentiality and integrity of communications protected by *_psk0 post-quantum variants.

Affected Products

Clatter (Rust crate jmlepisto/clatter) versions prior to 2.2.0
Default patterns: noise_pqkk_psk0, noise_pqkn_psk0, noise_pqnk_psk0, noise_pqnn_psk0
Hybrid post-quantum handshake variants using psk0 placement

Discovery Timeline

2026-01-28 - CVE-2026-24785 published to NVD
2026-02-27 - Last updated in NVD database

Technical Details for CVE-2026-24785

Vulnerability Analysis

The Noise Protocol Framework defines a PSK validity rule that requires every encrypted payload to be protected by a key derived from at least one ephemeral DH (or KEM) output contributed by the local party. This binding ensures that an attacker cannot induce two sessions to derive the same encryption key purely from a static PSK. Clatter's pattern parser accepted post-quantum variants that placed the PSK token (psk0) before any local ephemeral contribution, breaking that binding.

The resulting handshakes produce CipherState keys derived solely from the PSK plus remote inputs the attacker can choose. Where the same PSK is provisioned across peers — the common deployment model — this enables key reuse and breaks confidentiality of encrypted handshake payloads. The issue is classified under [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.

Root Cause

Clatter's handshake pattern validator did not enforce the Noise validity rule against the post-quantum (KEM-based) pattern family. The library exposed convenience constructors such as noise_pqkk_psk0() and noise_pqnn_psk0() that produced non-compliant state machines without raising an error.

Attack Vector

A network-positioned attacker who can observe or initiate handshakes using an affected *_psk0 pattern may exploit key reuse to decrypt handshake payloads or correlate sessions. No authentication or user interaction is required to trigger the weak key derivation path.

rust

// Patch excerpt: offending psk0 post-quantum patterns removed from fuzz harness
         noise_pqin_psk1(),
         noise_pqin_psk2(),
         noise_pqix_psk2(),
-        noise_pqkk_psk0(),
         noise_pqkk_psk2(),
-        noise_pqkn_psk0(),
         noise_pqkn_psk2(),
         noise_pqkx_psk2(),
-        noise_pqnk_psk0(),
         noise_pqnk_psk2(),
-        noise_pqnn_psk0(),
         noise_pqnn_psk2(),
         noise_pqnx_psk2(),
         noise_pqxk_psk3(),
// Source: https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71

The patch also introduces a new PatternError variant so runtime checks can surface invalid patterns to callers:

rust

     Cipher(#[from] CipherError),
     /// Transport error: {0}
     Transport(#[from] TransportError),
+    /// Handshake pattern error: {0}
+    Pattern(#[from] PatternError),
 }
// Source: https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71

Detection Methods for CVE-2026-24785

Indicators of Compromise

Application logs or telemetry showing handshake initialization with pattern names ending in _psk0 for post-quantum variants (pqkk, pqkn, pqnk, pqnn).
Cargo.lock entries pinning clatter at versions earlier than 2.2.0.
Reuse of identical Noise transport keys across distinct sessions sharing the same PSK.

Detection Strategies

Inventory all Rust binaries and libraries that depend on the clatter crate using cargo tree or SBOM tooling.
Grep source repositories for direct calls to noise_pqkk_psk0, noise_pqkn_psk0, noise_pqnk_psk0, noise_pqnn_psk0, and custom hybrid patterns containing psk0.
Run the Clatter 2.2.0 runtime validator against existing configurations to surface non-compliant patterns through the new PatternError.

Monitoring Recommendations

Alert on outbound or inbound traffic where Noise handshake negotiation reports a pq*_psk0 pattern identifier.
Track dependency manifests in CI to flag downgrades or pinning of clatter below 2.2.0.
Monitor for repeated session keys or nonce collisions in protocols built on Clatter, which would indicate key reuse.

How to Mitigate CVE-2026-24785

Immediate Actions Required

Upgrade the clatter dependency to version 2.2.0 or later in all Rust projects.
Audit application code for use of the affected *_psk0 post-quantum patterns and migrate to *_psk1, *_psk2, or *_psk3 placements.
Rotate any PSKs that were provisioned for use with affected handshake patterns.

Patch Information

The fix is published in Clatter v2.2.0. The release removes the non-compliant constructors from the public API and adds runtime checks that return a PatternError when an offending pattern is instantiated. See the GitHub Security Advisory GHSA-253q-9q78-63x4 and the upstream commit b65ae6e for the complete change set.

Workarounds

Avoid all *_psk0 variants of post-quantum patterns until the upgrade is deployed.
Review custom handshake patterns against the Noise Protocol Validity Rule to confirm a local ephemeral contribution precedes any PSK token used for encryption.
Restrict PSK scope to a single peer pair where feasible to limit blast radius of key reuse.

bash

# Pin a safe version in Cargo.toml
cargo update -p clatter --precise 2.2.0
cargo tree -p clatter | grep clatter