EUVD-2026-28302
GHSA-fc55-xrcv-x657
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInteract with target Tor client
-
ExploitInduce circuit queue memory pressure
-
ExecutionTrigger double close of circuit
-
ImpactCrash client (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Improper enforcement of single unique action
|
| Exploitation Conditions | Exploitation requires the affected Tor client (versions before 0.4.9.7) to be in a state of 'circuit queue memory pressure'; the double-close crash occurs only when that memory-pressure condition exists, so a client with ample free queue memory is not affected. The sources do not describe how an attacker induces that memory-pressure state or whether it is reliably attacker-controllable, so the trigger is not fully described in the available sources. Limiting factors: impact is confined to a client crash (availability only) with no code execution or data compromise, and the fix is applying Tor 0.4.9.7 or later. |
| Impact | Signals are consistent and point to a moderate, availability-only issue rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores High solely on availability - confidentiality and integrity impact are None, confirming this is a denial-of-service (client crash) with no code execution or data exposure. EPSS is 0.04% (12th percentile), very low, indicating little predicted exploitation activity. The vulnerability is NOT in CISA KEV and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - all reinforcing low real-world urgency. No public exploit is referenced in the input (the linked GitLab commit is the fix, not exploit code). One tension worth flagging: the CVSS vector encodes AC:L (low complexity), yet the description conditions the crash on 'circuit queue memory pressure' existing, which is a stateful precondition the vector's AC:L does not reflect - verify triggerability with the vendor. Net: a legitimately patch-worthy DoS (hence the 'this_week' priority label) but not a high-real-risk, actively-exploited emergency; prioritize accordingly against RCE/credential-class issues. |
| Exploit ScenarioDerived | An attacker who can interact with a victim's Tor client and bring it into a circuit-queue memory-pressure state could trigger a double close of a circuit, crashing the client and denying the user anonymized connectivity. The impact is limited to availability (a client crash), with no confidentiality or integrity effect and no code execution. No public exploit code is referenced in the available data; the exact steps to reliably induce the memory-pressure precondition are not described in the sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 26, 2026
Double close of a circuit while a Tor client is under circuit queue memory pressure can crash the process in versions before 0.4.9.7, an availability-only denial of service tracked by the Tor project as TROVE-2026-009 (CWE-837). The crash occurs only when the memory-pressure condition already exists, and the available sources do not describe how an attacker would reliably induce that state, so impact is a client crash with no code execution, data disclosure, or integrity loss. No public exploit code was identified at time of analysis, SSVC records exploitation as none and automatable as no, and EPSS is 0.04% (12th percentile).
Earlier versions of this analysis (1)
Tor before version 0.4.9.7 can crash due to a double-close vulnerability in circuit handling when memory pressure conditions exist on the circuit queue, resulting in denial of service to affected clients. The vulnerability requires specific network conditions (high circuit queue load) to trigger but affects all Tor clients running vulnerable versions. A patch is available in Tor 0.4.9.7 and later.
RemediationAI
Vendor-released patch: Tor 0.4.9.7 or later, which contains the fix commit d4e3f6a4 (https://gitlab.torproject.org/tpo/core/tor/-/commit/d4e3f6a440b58c2be661decf20c09548704907dc); upgrade clients to 0.4.9.7 and confirm the running version after restart, following the release announcement at https://forum.torproject.org/c/news/tor-release-announcement/28 for the branch builds shipped alongside it. The sources describe no configuration workaround for the double close other than running a fixed build, and they do not document a way to prevent the circuit queue memory-pressure precondition, so treat upgrading as the complete fix and schedule it within the current week per the this_week priority rather than as an emergency action, consistent with SSVC exploitation none, automatable no, and EPSS 0.04%. Additional advisory detail is available at https://nvd.nist.gov/vuln/detail/CVE-2026-44601 and https://vuldb.com/vuln/361806.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tor clients maintain a queue of circuit structures awaiting construction or teardown, and the fix commit d4e3f6a4 in the tor core repository addresses a path where the same circuit is closed twice while that queue is under memory pressure. The weakness class is CWE-837, improper enforcement of a single, unique action, meaning a state-changing operation (circuit close) is not guarded against being applied more than once to the same object, leaving internal state inconsistent and terminating the client. The GitLab work item 41237 and the Tor release announcement for 0.4.9.7 document the change; the CPE cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* with EUVD's range "Tor 0 <0.4.9.7" covers all builds prior to the fixed release. NVD's published vector is 7.5 with AC:L, whereas this analysis reflects AC:H because the double close is gated on the circuit-queue memory-pressure precondition; in either reading, the resulting impact is confined to availability (A:H) with C:N and I:N, and the sources do not state how the memory-pressure state is reached.
Know when Tor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Availability-only client crash (C:N/I:N/A:H); AC:H because the crash is conditioned on an existing circuit-queue memory-pressure state not shown to be directly attacker-controlled; no auth or interaction required.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.
Executive ViewAI
A high-severity availability flaw in Tor client versions before 0.4.9.7 could allow an attacker to crash the Tor process when specific memory-pressure conditions are met, temporarily disrupting anonymity and connectivity for affected users. Although no active exploitation has been observed, the widespread use of Tor in privacy-sensitive and operational contexts warrants prompt remediation to prevent service interruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Tor Protocol Implementation Flaws
View all 6Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered whe
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Rendezvous-point impersonation in Tor before 0.4.9.11 lets a malicious relay that a client happens to select as its rend
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor
Use-after-free in Tor's conflux circuit handling allows a malicious Tor client to corrupt relay memory by sending a RELA
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Exploit-DB