CVE-2026-77638: Race Condition
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Tor versions before 0.4.9.11 are affected. The issue concerns onion-service connections that use a rendezvous point.
What must an attacker do to exploit this issue?
An attacker must be in the position of the rendezvous point and successfully trigger the race condition under the required circumstances. No client-side privileges or user interaction are required according to the supplied vector.
What is the potential impact of a successful attack?
A malicious rendezvous point could impersonate the onion service the client intended to reach. This can expose confidentiality and integrity of the affected connection, with limited availability impact.
What should operators do?
Upgrade Tor to version 0.4.9.11 or later. No alternative mitigation is provided in the available data.