EUVD-2026-14301
GHSA-p96h-94q2-fh5v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Impact | The risk profile is mixed and lower than initial CVSS scoring suggests. The CVSS 3.7 score with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N indicates network-reachable attack surface (AV:N) but high attack complexity (AC:H), no authentication required (PR:N), and only integrity impact (I:L)—meaning an attacker could theoretically manipulate signatures but cannot gain confidentiality or availability benefits. The EPSS probability shows this is difficult to exploit in practice. However, several factors mitigate this: first, the vendor responded professionally and released a patch quickly (commit af996b5ec27ab79bae3882071b9d6acf16044549), reducing window of exposure; second, real-world impact is explicitly doubted and unproven—the public POC on GitHub (py-thok/putty-ed25519-malleability-s-plus-l) appears academic rather than functional; third, the attack requires high complexity and is not reported as actively exploited in the wild. The tags (JWT Attack, Information Disclosure) suggest this is primarily a cryptographic weakness of interest to security researchers rather than an actively weaponized threat. Organizations should prioritize patching but may defer other security work. |
| Exploit ScenarioDerived | An attacker on the network path between a PuTTY client and SSH server could intercept or influence the SSH authentication exchange by crafting a malicious Ed25519 signature with an overlarge 's' component that exploits the weak verification logic in eddsa_verify. The attacker would then be able to forge or modify signatures in a way that passes PuTTY's validation, potentially enabling unauthorized SSH session establishment or man-in-the-middle attacks. However, executing this attack requires deep cryptographic knowledge, network positioning, and exploitation of the subtle malleability property (as detailed in the public POC at https://github.com/py-thok/putty-ed25519-malleability-s-plus-l/blob/main/poc.py), which explains why real-world exploitation remains theoretical rather than documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
PuTTY versions up to 0.83 contain a weak authentication vulnerability in the Ed25519 signature verification function (eddsa_verify in crypto/ecc-ssh.c) that allows remote attackers to potentially forge or manipulate digital signatures due to improper validation of Ed25519 signature components. While a public proof-of-concept exploit exists and the vulnerability affects signature verification, the real-world impact remains unproven, with CVSS 3.7 (low severity) and EPSS probability indicating exploitation is difficult and requires high complexity. The vendor (PuTTY developers) has already released a patch addressing this issue.
RemediationAI
Upgrade PuTTY to a version released after commit af996b5ec27ab79bae3882071b9d6acf16044549 (check the official PuTTY release page at https://www.chiark.greenend.org.uk/~sgtatham/putty/ for the next release following version 0.83). This patch addresses the Ed25519 signature verification weakness by properly validating signature component bounds per RFC 8032 section 8.4. Until patching is feasible, users should reduce exposure by restricting PuTTY SSH connections to known, trusted hosts and networks, and consider using SSH key pinning or certificate verification features where available. Organizations managing PuTTY deployments should prioritize this upgrade in their regular patching cycle but may phase it over normal update windows given the low CVSS and unproven real-world impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exists in PuTTY's implementation of Ed25519 signature verification, a component of the SSH protocol for cryptographic authentication. The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature), which involves the eddsa_verify function failing to properly validate Ed25519 signature parameters according to RFC 8032 specifications. Specifically, the vulnerability appears related to handling of overlarge 's' values in Ed25519 signatures—a malleability issue where an attacker could construct alternative valid-looking signatures that pass weak verification checks. The affected component is part of PuTTY's SSH cryptographic library, which handles key exchange and host authentication during remote sessions. The CPE affected is cpe:2.3:a:n/a:putty:*:*:*:*:*:*:*:*, indicating all versions up to the patch are potentially affected.
Know when Putty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The manipulation results in 弱身份验证. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is identified as af996b5ec27ab79bae3882071b9d6acf16044549. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a patch for the affected product. However, at the moment there is no proof that this flaw might have any real-world impact.
Executive ViewAI
CVE-2026-4115 is a low-severity vulnerability in A vulnerability (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Ed25519 Signature Handler Verification Flaws
View all 2The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows r
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large
Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduc
PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY
PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. Rated critical severity (CVS
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client for
PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication resp
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via
PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected b
Same technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.74-1+deb11u2 | - |
| bullseye (security) | vulnerable | 0.74-1+deb11u1 | - |
| bookworm | vulnerable | 0.78-2+deb12u2 | - |
| bookworm (security) | vulnerable | 0.78-2+deb12u1 | - |
| forky, sid, trixie | vulnerable | 0.83-3 | - |
| (unstable) | fixed | (unfixed) | unimportant |
Exploit-DB