CVE-2026-4115: 
NixOS vulnerability analysis and mitigation

CVE-2026-4115 is an improper Ed25519 cryptographic signature verification vulnerability in PuTTY 0.83, affecting the eddsa_verify function in crypto/ecc-ssh.c. The flaw allows a malleated Ed25519 signature — where the scalar S is replaced by S + L (the group order) — to be accepted as valid, violating the strict S < L requirement mandated by RFC 8032. It was published on March 22, 2026, with a patch (commit af996b5ec27ab79bae3882071b9d6acf16044549) released promptly by the vendor. The CVSS v3.1 base score is 3.7 (Low), and the CVSSv4 base score is 2.9 (Low). Notably, the PuTTY maintainer disputes that this constitutes a real vulnerability (Red Hat Advisory, Red Hat Bugzilla, oss-security).

The root cause is classified under CWE-347 (Improper Verification of Cryptographic Signature) and CWE-345 (Insufficient Verification of Data Authenticity). Ed25519 signatures consist of a point R and a scalar S; RFC 8032 §8.4 mandates that implementations reject signatures where S ≥ L (the group order) to prevent signature malleability. PuTTY 0.83's eddsa_verify function in crypto/ecc-ssh.c omits this check, allowing an attacker to take a valid signature and produce an alternative valid signature by computing S' = S + L, which the verifier accepts. The attack is network-based and requires high complexity, as the attacker must be in a position to manipulate SSH authentication data. A public PoC Python script demonstrates the bug by generating a valid Ed25519 signature, mutating it by adding L to S, and confirming both are accepted by PuTTY's ssh_key_verify function (PoC GitHub, PuTTY Wishlist).

The practical impact is limited to a low-integrity bypass: an attacker who possesses a valid Ed25519 signature can produce an alternative signature that PuTTY will also accept, potentially enabling signature forgery in SSH authentication scenarios. There is no confidentiality or availability impact, and no evidence of remote code execution or privilege escalation. The PuTTY maintainer explicitly states there is no proof this flaw has any real-world impact, and the vulnerability's existence as a security issue is disputed (Red Hat Bugzilla, oss-security).

1. Obtain a valid Ed25519 signature: The attacker must first obtain or observe a legitimate Ed25519 signature produced by a PuTTY 0.83 client during an SSH session (e.g., via a man-in-the-middle position on the network).
2. Extract the S component: Parse the 64-byte raw Ed25519 signature blob to extract the 32-byte R (point) and 32-byte S (scalar) components.
3. Compute malleated signature: Add the Ed25519 group order L (a 32-byte little-endian constant) to S using modular arithmetic to produce S' = S + L, forming a new 64-byte signature blob.
4. Submit malleated signature: Present the malleated signature (R, S') to PuTTY's eddsa_verify function in place of the original. Due to the missing S < L check, PuTTY 0.83 accepts both signatures as valid.
5. Verify acceptance: Confirm that ssh_key_verify returns True for the malleated signature, demonstrating the bypass. The PoC script automates steps 2–5 using PuTTY's own testcrypt binary (PoC GitHub).

The vendor released a patch identified as commit af996b5ec27ab79bae3882071b9d6acf16044549 in the PuTTY source repository, which adds the required S < L check to eddsa_verify. This fix is included in PuTTY 0.84, released in May 2026 alongside fixes for two other minor security issues. Users should upgrade to PuTTY 0.84 or later; given the low CVSS score and disputed real-world impact, this can be scheduled as part of routine maintenance (oss-security, Red Hat Advisory).

The PuTTY maintainer (Simon Tatham) explicitly disputes that CVE-2026-4115 constitutes a genuine vulnerability, stating on the PuTTY wishlist page that there is no proof of real-world impact and that the issue was assigned a CVE by VulDB without the maintainer's agreement. The oss-security mailing list post announcing PuTTY 0.84 noted that VulDB issued the CVE for a bug the maintainer does not believe is a vulnerability, with a detailed discussion linked on the PuTTY wishlist. Red Hat triaged the issue as low severity. Coverage appeared in security news outlets (GBHackers, CyberSecurityNews, Cryptika) primarily in the context of the broader PuTTY 0.84 release rather than treating CVE-2026-4115 as a significant standalone threat (oss-security, PuTTY Wishlist).