See how the tor project compares to other vendors in security performance
Tor before 0.4.9.12 interprets the CCRESPONSE extension even when CCREQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge() was ignored, so a send failure (which calls circuitmarkforclose() and removes the leg via cfxdelleg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.