Threats affecting pkg:cargo/github/jmlepisto/clatter

CVE-2026-24785 is a high-severity vulnerability in the Clatter Rust library, a no_std compatible implementation of the Noise protocol framework with post-quantum support. Versions prior to 2.2.0 allow the use of post-quantum handshake patterns that violate the PSK validity rule, enabling PSK-derived keys to be used without proper ephemeral randomness. This cryptographic flaw weakens security guarantees and risks catastrophic key reuse. The affected handshake patterns include several default `*_psk0` variants and some hybrid patterns. The issue is addressed in Clatter v2.2.0, which adds runtime checks to prevent insecure handshake patterns. Organizations using vulnerable versions and affected patterns may have compromised handshake security, risking confidentiality and integrity of communications.