https://seclists.org/oss-sec/2026/q4/92: tor-0.4.9.14 leased

Q: Which Tor deployments should be prioritized for the update?

The release notes state that the fixes affect all Tor components: relays, clients, onion services, and authorities. Operators and users of each of these roles should upgrade as soon as possible.

Q: What is required to trigger the Conflux-related relay failure?

A client could link a rendezvous-point circuit into a Conflux set and send a LINK cell with a forged sequence number. This could make the relay tear down the set from within the rendezvous splice and trigger a fatal assertion.

Q: What is the impact of the MiddleOnly handling issue?

On non-authority instances, the MiddleOnly flag was ignored because it was not copied from router statuses to node objects. As a result, clients could select MiddleOnly relays for inappropriate roles in onion service circuits.

Published Oct 7, 2026

Updated

Affected Software

1 affected component

The Tor Project Tor>=0.4.8.1-alpha<0.4.9.14, >=0.4.8.15<0.4.9.14, >=0.4.9.2-alpha<0.4.9.14

Frequently Asked Questions

Which Tor deployments should be prioritized for the update?

The release notes state that the fixes affect all Tor components: relays, clients, onion services, and authorities. Operators and users of each of these roles should upgrade as soon as possible.

What is required to trigger the Conflux-related relay failure?

A client could link a rendezvous-point circuit into a Conflux set and send a LINK cell with a forged sequence number. This could make the relay tear down the set from within the rendezvous splice and trigger a fatal assertion.

What is the impact of the MiddleOnly handling issue?

On non-authority instances, the MiddleOnly flag was ignored because it was not copied from router statuses to node objects. As a result, clients could select MiddleOnly relays for inappropriate roles in onion service circuits.