{"id":"CVE-2024-58265","aliases":["RUSTSEC-2024-0011","GHSA-7g9j-g5jg-3vv3"],"title":"Unauthenticated Nonce Increment in snow","summary":"Unauthenticated Nonce Increment in snow","severity":"none","vendor":"snow","product":"snow","ecosystem":"rust","affected":["snow >= 0.0.0-0, < 0.9.5"],"patched":["snow 0.9.5"],"published":"2024-01-23","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:03.400491142Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0011","references":[{"url":"https://crates.io/crates/snow"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0011.html"},{"url":"https://github.com/mcginty/snow/commit/12e8ae55547ae297d5f70599e5c884ea891303eb"}],"tags":["osv","rust"],"epss":0.00437,"epssPercentile":0.37826,"ingestedAt":"2026-10-13T11:45:30.166Z","slug":"CVE-2024-58265","body":"## Overview\n\nThere was a logic bug where unauthenticated payloads could still cause a nonce\nincrement in snow's internal state. For an attacker with privileges to inject\npackets into the channel over which the Noise session operates, this could\nallow a denial-of-service attack which could prevent message delivery by\nsending garbage data.\n\nNote that this only affects those who are using the stateful TransportState,\nnot those using StatelessTransportState.\n\nThis has been patched in version 0.9.5, and all users are recommended to\nupdate.\n\n## Affected packages\n\n- `snow >= 0.0.0-0, < 0.9.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `snow 0.9.5`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}