EUVD-2026-63647
GHSA-pq38-gw56-4w65
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Network-exploitable race requiring relay selection and timing win with no credentials; scope change reflects full client session compromise beyond the relay itself.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
AnalysisAI
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point circuit negotiation, allowing a malicious relay operator acting as the rendezvous point to substitute itself for the intended onion service before the legitimate service completes authentication. The flaw affects all Tor application versions prior to 0.4.9.11 across all platforms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must operate a Tor relay that is probabilistically selected by the victim client as the rendezvous point - selection likelihood increases with relay bandwidth weight, so a well-resourced attacker running high-capacity relays improves odds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.9 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) is internally consistent with the described vulnerability: high attack complexity correctly reflects the race condition's timing sensitivity and probabilistic relay-selection dependency, while the Changed Scope metric captures that impersonation harms the client system's security posture beyond the rendezvous relay itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operates one or more high-bandwidth Tor relays to increase the statistical probability of being selected as the rendezvous point for a target client's onion service circuit. When the attacker's relay is selected and the client initiates rendezvous completion, the attacker exploits the narrow race condition window to finalize the circuit impersonating the target onion service before the legitimate service can respond. … |
| Remediation | Upgrade Tor to version 0.4.9.11 or later; this is the vendor-confirmed fix as documented in the Tor Project ChangeLog at https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Tor and document current versions; if onion service usage is discretionary, disable until patches available and disable systems from acting as relays. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today