CVE-2021-33500

PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. NOTE: the same attack methodology may affect some OS-level GUIs on Linux or other platforms for similar reasons.

• https://docs.ssh-mitm.at/puttydos.htmlExploit, Third Party Advisory
• https://github.com/ssh-mitm/ssh-mitm-plugins/blob/main/ssh_mitm_plugins/ssh/putty_dos.pyExploit, Third Party Advisory
• https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.htmlRelease Notes, Third Party Advisory
• https://docs.ssh-mitm.at/puttydos.htmlExploit, Third Party Advisory
• https://github.com/ssh-mitm/ssh-mitm-plugins/blob/main/ssh_mitm_plugins/ssh/putty_dos.pyExploit, Third Party Advisory
• https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.htmlRelease Notes, Third Party Advisory

Published

May 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33495OX App Suite 7.10.5 allows XSS via an OX Chat system message…6.1
• CVE-2021-33496Dutchcoders transfer.sh before 1.2.4 allows XSS via an inlin…6.1
• CVE-2021-33497Dutchcoders transfer.sh before 1.2.4 allows Directory Traver…9.1
• CVE-2021-33498Pexip Infinity before 26 allows remote denial of service bec…7.5
• CVE-2021-33499Pexip Infinity before 26 allows remote denial of service bec…7.5
• CVE-2021-3350deleteaccount.php in the Delete Account plugin 1.4 for MyBB …6.1
• CVE-2021-33501Overwolf Client 0.169.0.22 allows XSS, with resultant Remote…9.6
• CVE-2021-33502The normalize-url package before 4.5.1, 5.x before 5.3.1, an…7.5
• CVE-2021-33503An issue was discovered in urllib3 before 1.26.5. When provi…7.5
• CVE-2021-33504Couchbase Server before 7.1.0 has Incorrect Access Control.4.9
• CVE-2021-33505A local malicious user can circumvent the Falco detection en…7.8
• CVE-2021-33506jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not …7.5