openSUSE-SU-2026:20851-1 Security update for putty
PuTTY contains a double-free and crash in RSA/ECDSA handling, allowing remote attackers to cause denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is openSUSE-SU-2026:20851-1?
openSUSE-SU-2026:20851-1 is a memory corruption vulnerability, published on 31 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for putty fixes the following issues:
Changes in putty:
- Update to release 0.84
- Fixed a remotely triggerable double-free in RSA key exchange.
- Fixed a remotely triggerable crash (assertion failure - program termination) in NIST ECDSA signature verification.
- Fixed marking of Telnet and Rlogin session data with a trust sigil after you authenticated to a proxy (possibly allowing a server to spoof a repeat proxy password prompt).
- New ability to run a specified command before starting the connection, e.g. to perform wake-on-LAN or a port knock.
- Display 'pre-edit text', showing the progress of using multiple keystrokes to compose a single Unicode character.
- Improved support for to running the GUI tools on Wayland (fixed startup issues and tuned performance).
- Configuring a SSH certificate authority used to fail unless you manually made a config directory, now fixed.
- Fixed a spurious "Network error: Socket is not connected" when authenticating to some HTTP proxies.
Which versions are affected by openSUSE-SU-2026:20851-1?
How do I fix openSUSE-SU-2026:20851-1?
No fix has been published for openSUSE-SU-2026:20851-1 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is openSUSE-SU-2026:20851-1 being exploited?
There is no known exploitation of openSUSE-SU-2026:20851-1 in the wild and no public exploit code.