{"id":"openSUSE-SU-2026:22127-1","summary":"Security update for putty","details":"This update for putty fixes the following issues:\n\nChanges in putty:\n\n- Update to release 0.85\n\n  * Fixed a remotely triggerable use-after-free in Pageant.\n  * Fixed a remotely triggerable buffer overflow if the OpenSSH\n    encrypt-then-MAC cipher modes are in use. (Only used if a\n    server supports nothing else.)\n  * Fixed a buffer overflow in private key decryption, if the\n    private key is constructed maliciously. (Only triggerable on\n    purpose if you let somebody else generate a key for you.)\n  * Denial-of-service security fixes for where a server could\n    trigger a tight loop in PuTTY, and even a MITM can make it\n    consume unlimited memory at startup.\n\n- Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short  [boo#1266375, CVE-2026-48850]\n- Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature  [boo#1266373, CVE-2026-48852]\n- Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing  [boo#1266374, CVE-2026-48851]\n","modified":"2026-10-20T19:15:04.882448721Z","published":"2026-10-19T16:05:00Z","related":["CVE-2026-48850","CVE-2026-48851","CVE-2026-48852"],"upstream":["CVE-2026-48850","CVE-2026-48851","CVE-2026-48852"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266373"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266374"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266375"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48850"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48851"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48852"}],"affected":[{"package":{"name":"putty","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/putty&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.85-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"putty":"0.85-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22127-1.json"}}],"schema_version":"1.9.0"}