PKCS11SSHAgent

SRO PKCS11 – SSH Agent CNG Sovereign unification PKCS11 + SSH-agent + Pageant + CNG/Smartcard A single Windows executable that unifies four traditionally separate functions: Full PKCS11 module Firefox, OpenSC, ssh -I SSH agent compatible with OpenSSH/Git/VS/WSL Pageant server compatible with...

GHSA-662X-8WVJ-2276 pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Summary pageant::PageantStream reads a 4-byte big-endian length prefix from its input stream and buffers until len + 4 bytes are available, without ever validating len. The underlying WMCOPYDATA transport physically cannot carry frames larger than 8 KiB AGENTMAXMSGLEN, the fixed-size shared memor...

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Summary pageant::PageantStream reads a 4-byte big-endian length prefix from its input stream and buffers until len + 4 bytes are available, without ever validating len. The underlying WMCOPYDATA transport physically cannot carry frames larger than 8 KiB AGENTMAXMSGLEN, the fixed-size shared memor...

EUVD-2026-111390

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix memory-exhaustion DoS...

CVE-2026-116775

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

CVE-2026-116775 pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

CVE-2026-116775 pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

CVE-2026-116775 pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

CVE-2026-116775

The pageant library (versions 0.2.0 through 0.2.5 ) is vulnerable to a memory-exhaustion Denial of Service (DoS) due to unbounded frame buffering. The root cause is located in PageantStream::new within pageant/src/wmmessage.rs, which trusts a peer-controlled four-byte length prefix and buffers da...

CVE-2026-116775

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

PT-2026-127232

Name of the Vulnerable Software and Affected Versions pageant versions 0.2.0 through 0.2.4 Description The PageantStream type, which implements AsyncRead and AsyncWrite traits for communication with a Pageant instance, contains a flaw in the PageantStream::new function within...

CVE-2026-116775: Allocation of Resources Without Limits or Throttling

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

openSUSE 16 Security Update : putty (openSUSE-SU-2026:22127-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22127-1 advisory. Changes in putty: - Update to release 0.85 Fixed a remotely triggerable use-after-free in Pageant. Fixed a remotely triggerable buffer overflow ...

Security update for putty (moderate)

openSUSE security update: security update for putty ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22127-1 Rating: moderate References: bsc1266373 bsc1266374 bsc1266375 Cross-References: CVE-2026-48850 CVE-2026-48851 CVE-2026-48852 Affected Product...

OPENSUSE-SU-2026:22127-1 Security update for putty

This update for putty fixes the following issues: Changes in putty: - Update to release 0.85 Fixed a remotely triggerable use-after-free in Pageant. Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. Only used if a server supports nothing else...

GHSA-G4MP-VGX3-XRVM pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Summary MemoryMap::read in the pageant crate part of the russh workspace, used by russh's SSH-agent client on Windows via AgentClient::connectpageant copies a peer-controlled number of bytes out of an 8192-byte shared-memory view with no bounds check — unlike the sibling MemoryMap::write, which...

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Summary MemoryMap::read in the pageant crate part of the russh workspace, used by russh's SSH-agent client on Windows via AgentClient::connectpageant copies a peer-controlled number of bytes out of an 8192-byte shared-memory view with no bounds check — unlike the sibling MemoryMap::write, which...

EUVD-2026-89203

pageant: Out-of-bounds read / oversized allocation in pageant MemoryMap::read via a malicious Pageant agent Windows...

CVE-2026-102820

A flaw was found in pageant. On Windows, the component fails to properly validate the response length received through shared memory when communicating with an authentication agent. A local attacker impersonating the agent can supply a manipulated length value, triggering an oversized memory...

DEBIAN-CVE-2026-102820

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied...