EUVD-2026-74539
GHSA-c2x3-p37c-phvc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Sending CC_RESPONSE without CC_REQUEST requires no special race or timing; pure availability impact since the node crashes with no confidentiality or verifiable integrity effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
AnalysisAI
Remote denial-of-service in Tor before 0.4.9.12 allows any unauthenticated network peer to crash a Tor relay or client by transmitting a CC_RESPONSE congestion-control extension without a prior CC_REQUEST, corrupting the node's internal congestion-control state. Affected releases span 0.4.9.3-alpha through 0.4.9.11; the Tor Project patched this in 0.4.9.12 (TROVE-2026-032) with a ChangeLog entry and source commit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must run Tor 0.4.9.3-alpha through 0.4.9.11. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) reflects network accessibility and high availability impact moderated by a high-complexity rating - yet even a mid-sized privacy infrastructure operator in rybnik running public Tor relay nodes should treat this as operationally urgent, because the AC:H designation likely overstates practical difficulty: the triggering condition requires only sending CC_RESPONSE without a prior CC_REQUEST, which any peer can engineer trivially by omitting the request step, suggesting real-world exploitability is closer to AC:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Tor 0.4.9.12 or later, which includes the fix for TROVE-2026-032 as documented in the official ChangeLog (https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.12/ChangeLog) and the upstream remediation commit (https://gitlab.com/torproject/tor/-/commit/10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered whe
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point c
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today