The linked page doesn't list details on the security vulnerabilities but the mailing list announcement does: https://lists.tartarus.org/pipermail/putty-announce

The linked page doesn't list details on the security vulnerabilities but the mailing list announcement does: https://lists.tartarus.org/pipermail/putty-announce/2019/000027.html https://lists.tartarus.org/pipermail/putty-announce/2019/000... Most major seems to be this: A malicious server could trigger a buffer overrun by abusing the RSA key exchange protocol. This would happen before host key verification, so even if you trust the server you intended to connect to, you would still be at risk.