PuTTY 0.84 Patches High-Severity SSH and Telnet Vulnerabilities

Key Takeaways

• PuTTY version 0.84 has been released, addressing several security vulnerabilities within its SSH and Telnet client software.
• The patched flaws include denial-of-service vulnerabilities in SSH key exchange mechanisms and a prompt spoofing weakness in Telnet.
• While generally considered low severity, these issues could be exploited by malicious servers or man-in-the-middle attackers to crash clients or deceive users.
• Users are strongly advised to upgrade to PuTTY 0.84 immediately to secure their remote access sessions.

PuTTY 0.84 Addresses Multiple Security Flaws

The developers behind PuTTY, a widely used open-source SSH and Telnet client, have released version 0.84. This update integrates critical fixes for several security vulnerabilities, primarily targeting weaknesses in cryptographic handling and session management that could lead to crashes or user deception.

Although the identified flaws are not deemed high-severity, they underscore the potential for even minor implementation errors to be leveraged in specific attack scenarios, particularly by malicious servers or through man-in-the-middle (MITM) interceptions.

SSH Key Exchange Vulnerabilities

One significant fix in PuTTY 0.84 resolves a flaw in the ECDSA signature verification process that could cause the client to terminate abruptly during the SSH handshake. This issue stems from incorrect handling of elliptic curve arithmetic, specifically when processing points with identical y-coordinates, which, while mathematically valid, triggered an assertion failure in PuTTY’s code.

Because this verification step precedes host key validation, an attacker could craft a special key and signature to reliably crash vulnerable clients. The flaw impacts PuTTY versions from 0.71 onwards and affects NIST-based curves such as P256, P384, and P521, though modern curves like Ed25519 remain unaffected. The consequence of this vulnerability is limited to a denial-of-service condition, potentially disrupting sessions or causing loss of terminal output.

Another resolved issue concerns a double-free vulnerability within PuTTY’s implementation of RSA-based key exchange, as defined in RFC 4432. This defect manifests when the application processes malformed or unexpectedly short RSA keys under error conditions, erroneously attempting to free the same memory structure twice, resulting in a crash. This vulnerability affects versions 0.72 through 0.83 and can be triggered remotely by a malicious server sending a truncated key. Similar to the ECDSA flaw, this occurs before host key verification, making MITM exploitation a possibility. However, there is no current evidence suggesting this bug can be exploited for arbitrary code execution, thereby limiting its impact to denial-of-service.

Telnet Prompt Spoofing and Trust Issues

The latest release also rectifies a subtle but important issue within Telnet sessions related to PuTTY’s “trust sigil” feature. This visual indicator is designed to help users differentiate between legitimate client-generated prompts and potentially malicious prompts originating from a server. In prior versions, when users authenticated via a proxy, the trust state was not correctly reset before the Telnet session commenced. Consequently, all subsequent server messages were erroneously marked as trusted, potentially tricking users into revealing sensitive information, such as proxy passwords.

While this scenario requires specific conditions and relies on legacy protocols like Telnet, it still presents a realistic risk in environments where such protocols remain in use.

CVE-2026-4115 and Overall Robustness

In addition to these fixes, a separate issue, CVE-2026-4115, related to EdDSA signature handling, was also addressed. According to PuTTY maintainer Alan Coopersmith, despite receiving a CVE designation from external parties, this particular issue does not constitute a genuine security vulnerability.

Overall, PuTTY 0.84 significantly enhances the client’s robustness by eliminating edge-case vulnerabilities that could be exploited for disruption or deception.

What You Should Do

• Upgrade Immediately: All users of PuTTY should upgrade to version 0.84 without delay to protect against these vulnerabilities.
• Avoid Telnet: Where possible, migrate away from outdated and insecure protocols like Telnet in favor of SSH for all remote access needs.
• Verify Server Identities: Always exercise caution and verify the authenticity of servers, especially when prompted for credentials, to mitigate potential MITM attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.