Executive brief
PuTTY is a widely used open-source terminal emulator and network file transfer application. A flaw was identified in how it verifies digital signatures for certain secure connections (Ed25519). While an attacker could technically modify a valid signature into a different but still 'valid' format, there is currently no evidence that this allows for unauthorized access or data theft in real-world SSH scenarios.
Technical details
A signature malleability vulnerability exists in PuTTY's Ed25519 signature handler within `crypto/ecc-ssh.c`. The `eddsa_verify` function fails to strictly enforce the RFC 8032 requirement that the 's' value be less than the curve's base point order (L). Instead, PuTTY reduces overlarge values of 's' modulo L, allowing an attacker to modify a valid signature into a non-canonical but accepted form. While this violates 'strong unforgeability' (SUF-CMA), the vendor disputes the practical impact in the context of SSH, as the signature bits are not used as input for subsequent session keys or MACs. A patch was released in version 0.84 (commit af996b5).
Affected products
- PuTTY PuTTY 0.68 through 0.83
Timeline
- 2026-02: disclosed: Reported to vendor via email
- 2026-03-22: advisory: Public disclosure and CVE assignment
- 2026-03-22: patched: Vendor released fix in version 0.84
References
- https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=af996b5ec27ab79bae3882071b9d6acf16044549
- https://github.com/py-thok/putty-ed25519-malleability-s-plus-l
- https://github.com/py-thok/putty-ed25519-malleability-s-plus-l/blob/main/poc.py
- https://vuldb.com/?ctiid.352429
- https://vuldb.com/?id.352429
- https://vuldb.com/?submit.775576
- https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/eddsa-overlarge-s.html