Putty vulnerabilities

Products

• Putty 36

Newest

• putty PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification. CVE-2026-48852 Fix available 3.7 LowMay 25, 2026
• putty PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but... CVE-2026-48851 Fix available 3.1 LowMay 25, 2026
• putty PuTTY 0.72 before 0.84 has a double free in RSA KEX. CVE-2026-48850 Fix available 3.7 LowMay 25, 2026
• putty PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification CVE-2026-4115 Fix availableDisputed 6.3 MediumMarch 22, 2026
• putty, tigris tortoisesvn, tortoisegit +3 more +5 more In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to... CVE-2024-31497 Public exploitFix available 5.9 MediumApril 15, 2024
• 9bis kitty, apache sshd, sshj +68 more +70 more Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795 Public exploitFix available EPSS 93.5% 5.9 MediumDecember 18, 2023
• putty PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a... CVE-2021-36367 Fix available 8.1 HighJuly 9, 2021
• putty PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang... CVE-2021-33500 7.5 HighMay 21, 2021
• putty, fedoraproject fedora, netapp oncommand unified manager core package +2 more PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the... CVE-2020-14002 Fix available 5.9 MediumJune 29, 2020
• putty PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows... CVE-2019-17067 9.8 CriticalOctober 1, 2019
• putty, opensuse leap +1 more PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a... CVE-2019-17068 Fix available 7.5 HighOctober 1, 2019
• putty, netapp oncommand unified manager core package, opensuse leap +2 more PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing... CVE-2019-17069 Fix available 7.5 HighOctober 1, 2019
• putty, debian linux, fedoraproject fedora +2 more +4 more Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. CVE-2019-9898 Fix available 9.8 CriticalMarch 21, 2019
• putty, debian linux, fedoraproject fedora +2 more +4 more Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in... CVE-2019-9897 Fix available 7.5 HighMarch 21, 2019
• putty, opensuse backports sle, leap +2 more In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting... CVE-2019-9896 Public exploitFix available 7.8 HighMarch 21, 2019
• putty, fedoraproject fedora +1 more In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind... CVE-2019-9895 Fix available 9.8 CriticalMarch 21, 2019
• putty, debian linux, fedoraproject fedora +2 more +4 more A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before... CVE-2019-9894 Fix available 7.5 HighMarch 21, 2019
• putty, opensuse leap +1 more The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have... CVE-2017-6542 Public exploitFix available EPSS 21.8% 9.8 CriticalMarch 27, 2017
• putty Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute... CVE-2016-6167 7.8 HighJanuary 30, 2017
• putty, debian linux, fedoraproject fedora +1 more +3 more The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not... CVE-2015-2157 Fix available 2.1 LowMarch 6, 2015
• putty PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that... CVE-2011-4607 Fix available 2.1 LowAugust 23, 2013
• putty, winscp, debian linux +1 more +3 more Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use... CVE-2013-4852 Fix available 6.8 MediumAugust 9, 2013
• putty The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after... CVE-2013-4208 Fix available 2.1 LowAugust 9, 2013
• putty Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of... CVE-2013-4207 Fix available 4.3 MediumAugust 9, 2013
• putty Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote... CVE-2013-4206 Fix available 6.8 MediumAugust 9, 2013
• putty PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys... CVE-2006-7162 Fix available 1.9 LowMarch 7, 2007
• putty Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in... CVE-2005-0467 Fix available 7.5 HighFebruary 21, 2005
• putty Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote... CVE-2004-1440 Fix available 7.5 HighDecember 31, 2004
• putty, tortoisecvs +1 more Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers... CVE-2004-1008 Fix available 10.0 HighDecember 1, 2004
• putty The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain... CVE-2003-0069 Fix available 7.5 HighMarch 18, 2003
• putty PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext... CVE-2003-0048 Fix available 4.6 MediumFebruary 1, 2003
• cisco ios, fissh ssh client, intersoft securenetterm +4 more +6 more Multiple SSH2 servers and clients do not properly handle strings with null characters in them... CVE-2002-1360 10.0 HighDecember 17, 2002
• cisco ios, fissh ssh client, intersoft securenetterm +4 more +6 more Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may... CVE-2002-1359 Public exploit EPSS 80.2% 10.0 HighDecember 17, 2002
• cisco ios, fissh ssh client, intersoft securenetterm +4 more +6 more Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings,... CVE-2002-1358 10.0 HighDecember 17, 2002
• cisco ios, fissh ssh client, intersoft securenetterm +4 more +6 more Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect... CVE-2002-1357 10.0 HighDecember 17, 2002
• michael jennings eterm, rxvt, putty +1 more +3 more xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape... CVE-2000-0476 Public exploit 5.0 MediumJune 1, 2000