---
id: CVE-2024-58265
aliases:
  - RUSTSEC-2024-0011
  - GHSA-7g9j-g5jg-3vv3
title: Unauthenticated Nonce Increment in snow
summary: Unauthenticated Nonce Increment in snow
severity: none
vendor: snow
product: snow
ecosystem: rust
affected:
  - 'snow >= 0.0.0-0, < 0.9.5'
patched:
  - snow 0.9.5
published: '2024-01-23'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:03.400491142Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2024-0011'
references:
  - url: 'https://crates.io/crates/snow'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2024-0011.html'
  - url: >-
      https://github.com/mcginty/snow/commit/12e8ae55547ae297d5f70599e5c884ea891303eb
tags:
  - osv
  - rust
epss: 0.00437
epssPercentile: 0.37826
ingestedAt: '2026-10-13T11:45:30.166Z'
---

## Overview

There was a logic bug where unauthenticated payloads could still cause a nonce
increment in snow's internal state. For an attacker with privileges to inject
packets into the channel over which the Noise session operates, this could
allow a denial-of-service attack which could prevent message delivery by
sending garbage data.

Note that this only affects those who are using the stateful TransportState,
not those using StatelessTransportState.

This has been patched in version 0.9.5, and all users are recommended to
update.

## Affected packages

- `snow >= 0.0.0-0, < 0.9.5`

## Remediation

Upgrade to a patched release:

- `snow 0.9.5`