CVE-2026-44599
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
3.7 LowFix available
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.29%Up 0.3 points since May 7, 2026
What each source reports
CVE List Score used
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
CVE-2026-44599- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
EUVDEUVD-2026-28238
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
EUVD-2026-28238- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rprm-6mg6-r8fm
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
GHSA-rprm-6mg6-r8fm- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
NVD
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
CVE-2026-44599- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
OSV
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
CVE-2026-44599- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-44599
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
DEBIAN-CVE-2026-44599- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-44599
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Record
UBUNTU-CVE-2026-44599- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0187 No score
Updated tor packages fix security issues
This update provides lots of security issues fixed by upstream since our current version. Please see the links for details.
- Record
MGASA-2026-0187- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10735-1 No score
tor-0.4.9.8-1.1 on GA media
These are all security issues fixed in the tor-0.4.9.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10735-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20709-1 No score
Security update for tor
This update for tor fixes the following issues:
Changes in tor:
-
Update to 0.4.9.8
- Fix out-of-bounds read (boo#1264341, CVE-2026-44597, TROVE-2026-011)
- Do not attempt or accept BEGIN_DIR via conflux legs (boo#1264342, CVE-2026-44599,TROVE-2026-008)
- Adjust conflux out-of-order queue accounting when clearing a queue (boo#1264343, CVE-2026-44600, TROVE-2026-010)
- Fix a client-side crash caused by double-close of a circuit while under circuit queue memory pressure (boo#1264344, CVE-2026-44601, TROVE-2026-009)
- Fix null pointer dereference when receiving a CERT cell out of order (boo#1264345, CVE-2026-44602, TROVE-2026-006)
- Fix off-by-one out-of-bounds read if a malformed BEGIN cell is received (boo#1264346, CVE-2026-44603, TROVE-2026-007)
-
upate to 0.4.9.5:
- first stable release in the 0.4.9 series
- introduces a new circuit-level encryption design for better client security
- introduce a more scalable way for large relay operators to annotate which relays they run so clients can avoid using too many of them in a single circuit
- Record
openSUSE-SU-2026:20709-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
before 0.4.9.8-0+deb12u1, plus listed versions 0.4.7.13-10.4.7.16-10.4.8.10-10.4.8.10-1~bpo11+10.4.8.10-1~bpo12+1 Show 36 moreShow less0.4.8.11-10.4.8.11-1~bpo11+10.4.8.11-1~bpo12+10.4.8.12-10.4.8.12-1.10.4.8.12-1~bpo11+10.4.8.12-1~bpo12+10.4.8.13-10.4.8.13-20.4.8.13-2~bpo12+10.4.8.14-10.4.8.14-1~bpo12+10.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+20.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.8.4-20.4.8.5-10.4.8.6-10.4.8.7-10.4.8.8-10.4.8.9-10.4.8.9-1~bpo11+10.4.8.9-1~bpo12+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb12u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+1 |
0.4.9.8-0+deb12u1 |
torDebian:13 |
before 0.4.9.8-0+deb13u1, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 11 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb13u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+1 |
0.4.9.8-0+deb13u1 |
torDebian:14 |
before 0.4.9.8-1, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 12 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+1 |
0.4.9.8-1 |
torMageia:9 From an advisory covering 7 CVEs |
before 0.4.9.8-1.mga9 | 0.4.9.8-1.mga9 |
torUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.2.3.25-10.2.4.19-10.2.4.20-10.2.4.27-1build0.14.04.10.2.4.27-1ubuntu0.10.2.4.27-1ubuntu0.1+esm10.2.4.27-1ubuntu0.1+esm2 |
None known |
torUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.2.6.10-1ubuntu20.2.7.6-1ubuntu10.2.9.11-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.20.2.9.14-1ubuntu1~16.04.30.2.9.14-1ubuntu1~16.04.3+esm1 |
None known |
torUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.3.0.10-10.3.1.8-20.3.1.9-10.3.2.9-10.3.2.9-1build1 Show 4 moreShow less0.3.2.10-10.3.2.10-1ubuntu0.10.3.2.10-1ubuntu0.2~esm10.3.2.10-1ubuntu0.2~esm2 |
None known |
torUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.4.1.5-10.4.1.5-1build10.4.1.6-10.4.2.5-10.4.2.6-10.4.2.7-10.4.2.7-1ubuntu0.1~esm1 |
None known |
torUbuntu:22.04:LTS |
All versions, plus listed versions 0.4.5.9-10.4.6.8-10.4.6.8-1build10.4.6.9-10.4.6.10-10.4.9.11-0ubuntu0.22.04.1 |
None known |
torUbuntu:24.04:LTS |
All versions, plus listed versions 0.4.8.4-20.4.8.7-10.4.8.9-10.4.8.10-10.4.8.10-1build10.4.8.10-1build20.4.9.11-0ubuntu0.24.04.1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
torUbuntu:25.10 |
All versions, plus listed versions 0.4.8.14-10.4.8.16-1 |
None known |
torUbuntu:26.10 |
All versions, plus listed versions 0.4.9.6-10.4.9.8-10.4.9.11-10.4.9.11-1build1 |
None known |
torUbuntu:26.04:LTS |
All versions, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.22-10.4.9.6-10.4.9.11-0ubuntu0.26.04.1 |
None known |
toropenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 0.4.9.8-1.1 | 0.4.9.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44599 is a low vulnerability (CVSS 3.7) in Torproject Tor, published May 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in tor 0.4.9.8-0+deb12u1.
References
forum.torproject.org/c/news/tor-release-announcement/28
openwall.com/lists/oss-security/2026/05/06/8
gitlab.torproject.org/tpo/core/tor/-/work_items/41243
nvd.nist.gov/vuln/detail/CVE-2026-44599
github.com/advisories/GHSA-rprm-6mg6-r8fm
Show 20 moreShow less
security-tracker.debian.org/tracker/CVE-2026-44599
advisories.mageia.org/MGASA-2026-0187.html
bugs.mageia.org/show_bug.cgi?id=35486
ubuntu.com/security/CVE-2026-44599
cve.org/CVERecord?id=CVE-2026-44599
suse.com/security/cve/CVE-2026-44597
bugzilla.suse.com/1264341