clatter

no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support

View on Cargo

View on Github

Activity

Latest release: 2w ago
Total releases: 15
Cadence: ~daily
Last 12 months: 7

Reach

Downloads: 1.0M
Stars: 43

Details

License: MIT
First release: Nov 09, 2024

Releases

Version	Released
`2.3.0` minor	Aug 30, 2026
`2.2.0` unknown	Jan 27, 2026
`2.1.0` unknown 1 CVE	Dec 21, 2025
`2.1.0-rc.1` unknown 1 CVE	Nov 27, 2025
`2.0.0` unknown 1 CVE	Oct 06, 2025
`2.0.0-rc.2` unknown 1 CVE	Oct 06, 2025
`2.0.0-rc.1` unknown 1 CVE	Oct 05, 2025
`1.1.0` unknown 1 CVE	Dec 17, 2024
`1.0.0` unknown 1 CVE	Nov 15, 2024
`1.0.0-rc.2` unknown 1 CVE	Nov 14, 2024
`1.0.0-rc.1` unknown yanked 1 CVE	Nov 14, 2024
`0.1.3-alpha` unknown 1 CVE	Nov 11, 2024
`0.1.2-alpha` unknown 1 CVE	Nov 10, 2024
`0.1.1-alpha` unknown 1 CVE	Nov 09, 2024
`0.1.0-alpha` unknown yanked 1 CVE	Nov 09, 2024

Repository

jmlepisto/clatter

Forks: 5
Open issues: 4
Language: Rust

cryptography
cryptography-library
no-std
noise-protocol-framework
post-quantum-cryptography
noise-protocol

Dependencies (15)

Depends on

2.3.0

Used by

Supply-chain exposure

3 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

3 of 15

rand_core critical 1 CVE
pqcrypto-mlkem 1 CVE
pqcrypto-traits 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

CVE-2026-24785 GHSA-253q-9q78-63x4 Jan 28, 2026

Clatter has a PSK Validity Rule Violation issue

High
Network Low None None

Impact

Protocol compliance vulnerability. The library allowed post-quantum handshake patterns that violated the PSK validity rule (Noise Protocol Framework Section 9.3). This could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, weakening security guarantees and potentially allowing catastrophic key reuse.

Affected default patterns include noise_pqkk_psk0, noise_pqkn_psk0, noise_pqnk_psk0, noise_pqnn_psk0, and some hybrid variants. Users of these patterns may have been using handshakes that do not meet the intended security properties.

Patches

The issue is fully patched and released in Clatter v2.2.0. The fixed version includes runtime checks to detect offending handshake patterns.

Workarounds

Avoid using offending *_psk0 variants of post-quantum patterns. Review custom handshake patterns carefully.

Resources

PSK validity rule

Fixed in

2.2.0

References

https://github.com/jmlepisto/clatter/security/advisories/GHSA-253q-9q78-63x4
https://nvd.nist.gov/vuln/detail/CVE-2026-24785
https://github.com/jmlepisto/clatter/commit/b65ae6e9b8019bed5407771e21f89ddff17c5a71
https://github.com/jmlepisto/clatter
https://noiseprotocol.org/noise.html#validity-rule

Updated Feb 03, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 1
unknown 14

15 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More