https://seclists.org/oss-sec/2026/q3/916: Fwd: Tor Project Forum: Security lease 0.4.9.12

Q: Who could exploit the descriptor-handling issue?

A hostile cache could exploit it against a Tor client. The advisory also notes that a malicious guard could influence circuit construction toward relays of its choosing without Tor detecting the tampering.

Q: What should relay operators do?

Upgrade relays to the latest 0.4.9.x stable version as soon as possible. Authorities will no longer accept relay descriptors containing TAP keys, and new protocol versions are recommended for both clients and relays.

Q: Is this issue publicly known?

Yes. The release notes state that the bugs are public.

Published Sep 24, 2026

Updated

Affected Software

1 affected component

Tor Project Tor>=0.2.6.1-alpha<0.4.9.12

Frequently Asked Questions

Who could exploit the descriptor-handling issue?

A hostile cache could exploit it against a Tor client. The advisory also notes that a malicious guard could influence circuit construction toward relays of its choosing without Tor detecting the tampering.

What should relay operators do?

Upgrade relays to the latest 0.4.9.x stable version as soon as possible. Authorities will no longer accept relay descriptors containing TAP keys, and new protocol versions are recommended for both clients and relays.

Is this issue publicly known?

Yes. The release notes state that the bugs are public.