Tor EUVD-2026-28237

Exploitation requires Tor conflux protocol to be in use or enabled on the target system. The out-of-order queue clearing logic is only exercised during connection teardown or queue flush operations, meaning the attacker must trigger these operations through network-level packet manipulation. Attack complexity is rated high, indicating specific conditions must align: the attacker likely needs to send a precise sequence of reordered packets followed by rapid connection closure to hit the race condition or logic error in queue state management. No authentication is required - any network attacker can send packets to the Tor service - but the vulnerability is not exploitable against default passive configurations; active, targeted packet crafting is necessary. The impact is limited to availability (denial of service through resource exhaustion), not confidentiality or integrity, reducing the threat model for users concerned primarily with data exfiltration.

CVSS 3.7 with AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L indicates low overall severity, but the signals require careful interpretation. Attack vector is network (exploitable remotely) and requires no authentication, but attack complexity is HIGH - this suggests the vulnerability requires specific timing, packet sequencing, or network conditions to trigger the queue-clearing bug. The integrity and confidentiality impact are none, and availability impact is low, limiting the practical blast radius. No EPSS score, KEV status, or POC data provided, meaning there is no confirmed active exploitation or public exploit code. The real-world risk depends heavily on: (1) whether conflux is enabled by default (affects scope), (2) whether the required AC:H conditions are realistic for network attackers to achieve repeatedly, and (3) whether the availability impact is transient (temporary service hiccup) or persistent (permanent resource leak per connection). The Tor project's rapid response (patch committed; version 0.4.9.7 released) suggests they treated this as legitimate but not critical. This is likely a denial-of-service via resource exhaustion that impacts relay availability rather than user security.

An attacker on the network path to a Tor relay or client crafts a sequence of specially-ordered packets to trigger improper queue clearing in the conflux module. By repeatedly sending malformed out-of-order packets and abruptly terminating connections, the attacker forces the queue clearing logic to execute with invalid state, causing memory accounting to fail. Over time or through rapid connection churn, this exhausts relay/client memory, degrading availability until the process is restarted. Attack complexity is high, suggesting the attacker must have specific knowledge of packet timing or internal queue thresholds.