EUVD-2026-28304
GHSA-323g-q36v-hmmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Tor instance over network
-
ExploitSend CERT cell out of order
-
ExecutionTrigger NULL pointer dereference
-
ImpactCrash Tor process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific trigger is a CERT cell received out of order during the Tor link handshake, which dereferences a NULL pointer (CWE-476) and crashes the process; this is reachable remotely without authentication or user interaction (AV:N/PR:N/UI:N) against affected versions of Tor before 0.4.9.7. What limits it: impact is confined to availability (C:N/I:N, S:U) - a single Tor process crash with no data exposure or code execution - and SSVC rates it non-automatable with only partial technical impact, so it does not lend itself to self-propagating or mass exploitation. The only complete fix stated by the vendor is updating to Tor 0.4.9.7. |
| Impact | Signals point consistently to a genuine but moderate-urgency availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated crash with availability-only impact and no confidentiality or integrity loss - consistent with CWE-476 (NULL pointer dereference) and the Denial Of Service tag. The supporting signals temper this: EPSS is very low (0.04%, 12th percentile), there is no CISA KEV listing, and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial. These agree with each other - a crash bug that is not yet exploited and not mass-automatable. The vuln.today priority of 'this_week' and the available vendor patch make this a routine-but-prompt patching item, not a drop-everything event. No conflict exists between the network vector and the described trigger: receiving a CERT cell out of order is a network-delivered event. The main caveat is that 'Technical Impact: partial' (SSVC) pairs naturally with a single-process crash rather than full network compromise, so real-world damage is bounded by how the affected Tor instance is restarted/monitored. |
| Exploit ScenarioDerived | A remote attacker opens a connection to a vulnerable Tor instance (relay or client) and sends a CERT cell out of the expected handshake order, triggering a NULL pointer dereference that crashes the process and denies service. No authentication or user interaction is required (PR:N/UI:N). No public exploit identified at time of analysis; a vendor fix commit is referenced but is not an exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 26, 2026
A remotely reachable NULL pointer dereference in Tor before 0.4.9.7 lets any party that can complete a link handshake with a Tor process crash it by delivering a CERT cell out of the expected order (TROVE-2026-006). Impact is availability-only - no data exposure, no code execution, single-process crash - and the vector is unauthenticated and requires no user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H, 7.5). CISA SSVC rates exploitation as none and automatable as no with partial technical impact, EPSS is 0.04% (12th percentile), and no public exploit has been identified at time of analysis, so this reads as a moderate-urgency denial-of-service fix rather than an emergency; Tor 0.4.9.7 is the vendor's complete fix.
Earlier versions of this analysis (1)
Tor before version 0.4.9.7 crashes due to a NULL pointer dereference when CERT cells are received out of order, causing denial of service against relay nodes and clients. Remote unauthenticated attackers on the network can trigger this crash by sending malformed cell sequences, disabling affected Tor instances. No active exploitation confirmed, but the vulnerability affects core protocol handling in all affected versions.
RemediationAI
Vendor-released patch: Tor 0.4.9.7 - the Tor project states that updating to this version is the only complete fix, and operators of relays, bridges, onion services and clients running any earlier release should upgrade to 0.4.9.7 or later. The fix commit is df7d5174ef41814d806c8ede776e230cd30ac12b in the Tor core repository, and the release announcement at https://forum.torproject.org/c/news/tor-release-announcement/28 together with the oss-security post at https://www.openwall.com/lists/oss-security/2026/05/06/8 and the work item at https://gitlab.torproject.org/tpo/core/tor/-/work_items/41240 provide the vendor detail; the NVD record is https://nvd.nist.gov/vuln/detail/CVE-2026-44602. No documented workaround or configuration-level mitigation is provided in the available sources, and because the crash is reachable during the link handshake from any remote peer, restricting who can open connections to a Tor instance is not described by the vendor as an alternative to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tor's link protocol carries control information in cells; CERT cells convey certificate material used while establishing and validating the link handshake. The flaw is a CWE-476 NULL pointer dereference triggered specifically when a CERT cell arrives out of the sequence the code expects, causing the process to dereference a NULL pointer and crash. The primitive is therefore an availability-only denial of service against the affected Tor process; the supplied sources do not describe any path from the crash to memory corruption, information disclosure or code execution, and the assessed vector reflects that (C:N/I:N, S:U). Reachability is remote over the network with no privileges and no user interaction required (AV:N/AC:L/PR:N/UI:N), and the commit referenced at gitlab.torproject.org (df7d5174ef41814d806c8ede776e230cd30ac12b) corresponds to the upstream fix for this out-of-order-cell handling. EPSS of 0.04% and SSVC's non-automatable rating indicate the trigger does not lend itself to self-propagating or mass exploitation.
Know when Tor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity delivery of an out-of-order CERT cell (AV:N/AC:L/PR:N/UI:N); impact is a process crash only, so C:N/I:N/A:H, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.
Executive ViewAI
Tor 0.4.9.7 addresses a remotely triggerable crash (CVE-2026-44602) that allows any remote attacker to disrupt Tor processes by sending a malformed handshake message, causing a denial-of-service condition. Organizations relying on Tor for anonymized communications or relay operations face service interruptions, but no data exposure or code execution is possible. Leadership should prioritize patching due to the ease of triggering and the potential for operational disruption, though the absence of active exploitation lowers immediate urgency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Tor Protocol Implementation Flaws
View all 6Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered whe
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Rendezvous-point impersonation in Tor before 0.4.9.11 lets a malicious relay that a client happens to select as its rend
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor
Use-after-free in Tor's conflux circuit handling allows a malicious Tor client to corrupt relay memory by sending a RELA
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Exploit-DB