Tor Protocol Implementation Flaws

Out-of-bounds read by one byte in Tor before version 0.4.9.7 when processing malformed BEGIN cells allows remote unauthenticated attackers to cause a denial of service through information disclosure. The vulnerability has a low CVSS impact score (3.7) due to high attack complexity and limited availability impact, though the exact exploitation mechanics require Tor relay configuration and a specially crafted cell.

An out-of-bounds read in Tor before 0.4.9.7 can be triggered by a malicious circuit participant sending an END, TRUNCATE, or TRUNCATED cell whose payload omits the reason byte, potentially crashing the Tor process with limited confidentiality impact and high availability impact. Only relay or circuit-endpoint actors that can deliver the malformed cell within a circuit meet the exploitation conditions, and the assessed impact is most consistent with denial of service rather than confirmed remote data exfiltration. No public exploit was identified at time of analysis (EPSS 0.01%, SSVC exploitation: none); the vendor-released fix is Tor 0.4.9.7.

A remotely reachable NULL pointer dereference in Tor before 0.4.9.7 lets any party that can complete a link handshake with a Tor process crash it by delivering a CERT cell out of the expected order (TROVE-2026-006). Impact is availability-only - no data exposure, no code execution, single-process crash - and the vector is unauthenticated and requires no user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H, 7.5). CISA SSVC rates exploitation as none and automatable as no with partial technical impact, EPSS is 0.04% (12th percentile), and no public exploit has been identified at time of analysis, so this reads as a moderate-urgency denial-of-service fix rather than an emergency; Tor 0.4.9.7 is the vendor's complete fix.

Double close of a circuit while a Tor client is under circuit queue memory pressure can crash the process in versions before 0.4.9.7, an availability-only denial of service tracked by the Tor project as TROVE-2026-009 (CWE-837). The crash occurs only when the memory-pressure condition already exists, and the available sources do not describe how an attacker would reliably induce that state, so impact is a client crash with no code execution, data disclosure, or integrity loss. No public exploit code was identified at time of analysis, SSVC records exploitation as none and automatable as no, and EPSS is 0.04% (12th percentile).

Tor before version 0.4.9.7 can incorrectly attempt or accept BEGIN_DIR cells over conflux legs, a Tor relay multiplexing feature, enabling potential integrity violations in circuit construction. The vulnerability has a CVSS score of 3.7 (low severity) with impact limited to integrity rather than confidentiality or availability. No public exploit code or active exploitation has been identified at the time of analysis.

Tor before version 0.4.9.7 mishandles memory accounting in the conflux out-of-order queue during queue clearing operations, leading to a denial-of-service condition through resource exhaustion. Unauthenticated remote attackers can exploit this via network-level packet manipulation to trigger improper queue state management, causing availability degradation on affected Tor relays and clients. The vulnerability has a low severity CVSS score (3.7) due to attack complexity and availability-only impact, with no confirmed active exploitation at time of analysis.