https://seclists.org/oss-sec/2026/q4/92: tor-0.4.9.14 leased
Published Oct 7, 2026
·Updated
Affected Software
1 affected component
The Tor Project Tor>=0.4.8.1-alpha<0.4.9.14, >=0.4.8.15<0.4.9.14, >=0.4.9.2-alpha<0.4.9.14
The release notes state that the fixes affect all Tor components: relays, clients, onion services, and authorities. Operators and users of each of these roles should upgrade as soon as possible.
A client could link a rendezvous-point circuit into a Conflux set and send a LINK cell with a forged sequence number. This could make the relay tear down the set from within the rendezvous splice and trigger a fatal assertion.
On non-authority instances, the MiddleOnly flag was ignored because it was not copied from router statuses to node objects. As a result, clients could select MiddleOnly relays for inappropriate roles in onion service circuits.