CVE-2026-4115

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4115", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-13T12:09:58.769Z", "datePublished": "2026-03-22T12:15:07.531Z", "dateUpdated": "2026-05-25T01:42:39.715Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-22T12:20:27.727Z"}, "title": "PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-347", "lang": "en", "description": "Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-345", "lang": "en", "description": "Insufficient Verification of Data Authenticity"}]}], "affected": [{"vendor": "n/a", "product": "PuTTY", "versions": [{"version": "0.83", "status": "affected"}], "cpes": ["cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*"], "modules": ["Ed25519 Signature Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is identified as af996b5ec27ab79bae3882071b9d6acf16044549. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a patch for the affected product. However, at the moment there is no proof that this flaw might have any real-world impact."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-22T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-22T12:54:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "pythok (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.352429", "name": "VDB-352429 | PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.352429", "name": "VDB-352429 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.775576", "name": "Submit #775576 | PuTTY Project (Simon Tatham) PuTTY 0.83 Improper Verification of Cryptographic Signature", "tags": ["third-party-advisory"]}, {"url": "https://github.com/py-thok/putty-ed25519-malleability-s-plus-l", "tags": ["related"]}, {"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/eddsa-overlarge-s.html", "tags": ["related"]}, {"url": "https://github.com/py-thok/putty-ed25519-malleability-s-plus-l/blob/main/poc.py", "tags": ["exploit"]}, {"url": "https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=af996b5ec27ab79bae3882071b9d6acf16044549", "tags": ["patch"]}, {"url": "https://www.rfc-editor.org/rfc/rfc8032#section-8.4", "tags": ["related"]}], "tags": ["disputed", "x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:32:32.298237Z", "id": "CVE-2026-4115", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:32:42.204Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/24/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-25T01:42:39.715Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/24/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-25T01:42:39.715Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4115", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:32:32.298237Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:32:37.420Z"}}], "cna": {"tags": ["disputed", "x_open-source"], "title": "PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification", "credits": [{"lang": "en", "type": "reporter", "value": "pythok (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Ed25519 Signature Handler"], "product": "PuTTY", "versions": [{"status": "affected", "version": "0.83"}]}], "timeline": [{"lang": "en", "time": "2026-03-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-22T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-22T12:54:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.352429", "name": "VDB-352429 | PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.352429", "name": "VDB-352429 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.775576", "name": "Submit #775576 | PuTTY Project (Simon Tatham) PuTTY 0.83 Improper Verification of Cryptographic Signature", "tags": ["third-party-advisory"]}, {"url": "https://github.com/py-thok/putty-ed25519-malleability-s-plus-l", "tags": ["related"]}, {"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/eddsa-overlarge-s.html", "tags": ["related"]}, {"url": "https://github.com/py-thok/putty-ed25519-malleability-s-plus-l/blob/main/poc.py", "tags": ["exploit"]}, {"url": "https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=af996b5ec27ab79bae3882071b9d6acf16044549", "tags": ["patch"]}, {"url": "https://www.rfc-editor.org/rfc/rfc8032#section-8.4", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is identified as af996b5ec27ab79bae3882071b9d6acf16044549. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a patch for the affected product. However, at the moment there is no proof that this flaw might have any real-world impact."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-22T12:20:27.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4115", "state": "PUBLISHED", "dateUpdated": "2026-05-25T01:42:39.715Z", "dateReserved": "2026-03-13T12:09:58.769Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-22T12:15:07.531Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*"], "modules": ["Ed25519 Signature Handler"], "product": "PuTTY", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.83"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:putty:putty:0.83:*:*:*:*:*:*:*", "matchCriteriaId": "996A8841-3079-4C8D-A996-C1A75B2D788E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Signature Handler. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is identified as af996b5ec27ab79bae3882071b9d6acf16044549. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a patch for the affected product. However, at the moment there is no proof that this flaw might have any real-world impact."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en PuTTY 0.83. Afectada es la funci\u00f3n eddsa_verify del archivo crypto/ecc-ssh.c del componente Gestor de Firma Ed25519. La manipulaci\u00f3n resulta en verificaci\u00f3n impropia de firma criptogr\u00e1fica. El ataque puede ser realizado desde remoto. El ataque requiere un alto nivel de complejidad. La explotabilidad se dice que es dif\u00edcil. El exploit es ahora p\u00fablico y puede ser usado. La existencia real de esta vulnerabilidad todav\u00eda se duda en este momento. El parche se identifica como af996b5ec27ab79bae3882071b9d6acf16044549. Es aconsejable implementar un parche para corregir este problema. El proveedor fue contactado temprano, respondi\u00f3 de manera muy profesional y r\u00e1pidamente lanz\u00f3 un parche para el producto afectado. Sin embargo, en este momento no hay prueba de que este fallo pueda tener alg\u00fan impacto en el mundo real."}], "id": "CVE-2026-4115", "lastModified": "2026-06-17T10:56:00.850", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4115", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:32:32.298237Z", "version": "2.0.3"}}]}, "published": "2026-03-22T13:16:20.377", "references": [{"source": "cna@vuldb.com", "tags": ["Permissions Required"], "url": "https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=af996b5ec27ab79bae3882071b9d6acf16044549"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://github.com/py-thok/putty-ed25519-malleability-s-plus-l"}, {"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://github.com/py-thok/putty-ed25519-malleability-s-plus-l/blob/main/poc.py"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.352429"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.352429"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.775576"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/eddsa-overlarge-s.html"}, {"source": "cna@vuldb.com", "tags": ["Technical Description"], "url": "https://www.rfc-editor.org/rfc/rfc8032#section-8.4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/05/24/11"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-347"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.83"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PuTTY", "source": "cna", "vendor": "n/a"}, "product": "putty", "vendor": "putty"}], "analysis": {"en": {"generated_at": "2026-03-22T13:50:27.177422+00:00", "value": {"mitigation_remediation": ["Update PuTTY to the latest version that incorporates the eddsa_verify fix, or apply the patch provided by commit af996b5ec27ab79bae3882071b9d6acf16044549.", "Verify the integrity of the updated binary using the supplied checksum or digital signature.", "Audit active SSH sessions for any suspicious activity that may have occurred while the vulnerable version was in use.", "Keep monitoring vendor advisories for additional details on potential exploitation or persistence techniques."], "summary": {"action": "Apply Patch", "impact": "Improper verification of Ed25519 signatures"}, "threat_synthesis": {"affected_systems": "PuTTY version\u202f0.83 is affected. The flaw is present in the crypto/ecc-ssh.c component and was addressed by commit af996b5ec27ab79bae3882071b9d6acf16044549, which is included in later releases. Systems running the vulnerable version without this patch remain exposed to the risk described.", "description_and_impact": "PuTTY\u2019s Ed25519 signature handler contains a flaw that allows the eddsa_verify function to accept malformed or tampered signatures as authentic. This undermines the integrity of authentication procedures that rely on Ed25519, potentially enabling an attacker to impersonate a legitimate user or tamper with authenticated data. The weakness is rooted in improper signature validation, aligning with CWE\u2011345 and CWE\u2011347.", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity, and while the publicly available exploit exists, its manual description states high complexity and difficulty, with no current evidence of real\u2011world usage. The exploit can be launched remotely, but EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited large\u2011scale activity. Administrators should still consider the risk, particularly if PuTTY is used for critical authentication, and prioritize applying the patch promptly."}}}}, "created": "2026-03-23T09:46:31.760461+00:00", "updated": "2026-03-25T14:46:30.648555+00:00", "vendors": ["putty", "putty$PRODUCT$putty"]}