CVE-2019-9894

A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.

• CWE-320

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/04/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES/
• https://seclists.org/bugtraq/2019/Apr/6Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190404-0001/Patch, Third Party Advisory
• https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.htmlThird Party Advisory
• https://www.debian.org/security/2019/dsa-4423Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00020.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/04/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36LWQ3NPFIV7DC7TC4KFPRYRH2OR7SZ2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LDO3F267P347E6U2IILFCYW7JPTLCCES/
• https://seclists.org/bugtraq/2019/Apr/6Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190404-0001/Patch, Third Party Advisory
• https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.htmlThird Party Advisory
• https://www.debian.org/security/2019/dsa-4423Third Party Advisory

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9886Any URLs with download_attachment.php under templates or hom…7.5
• CVE-2019-9889In Vanilla before 2.6.4, a flaw exists within the getSingleI…
• CVE-2019-9890An issue was discovered in GitLab Community and Enterprise E…
• CVE-2019-9891The function getopt_simple as described in Advanced Bash Scr…
• CVE-2019-9892An issue was discovered in Open Ticket Request System (OTRS)…6.5
• CVE-2019-9893libseccomp before 2.4.0 did not correctly generate 64-bit sy…
• CVE-2019-9895In PuTTY versions before 0.71 on Unix, a remotely triggerabl…
• CVE-2019-9896In PuTTY versions before 0.71 on Windows, local attackers co…7.8
• CVE-2019-9897Multiple denial-of-service attacks that can be triggered by …
• CVE-2019-9898Potential recycling of random numbers used in cryptography e…
• CVE-2019-9900When parsing HTTP/1.x header values, Envoy 1.9.0 and before …8.3
• CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL paths. A …6.5