CVE-2026-77638

Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.

An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type (CVE-2026-77642). A NULL write after free when sending a CONFLUX_SWITCH cell fails, resulting in a crash (CVE-2026-77641). An infinite loop when decompressing a truncated zlib/gzip stream with done=1 (CVE-2026-77640). A compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams (CVE-2026-77639). A race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach (CVE-2026-77638). A use-after-free that a malicious exit node could use to crash a client (CVE-2026-77587). Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams (CVE-2026-77584).

These are all security issues fixed in the tor-0.4.9.11-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tor fixes the following issues:

Changes in tor:

• Update to 0.4.9.11

  • Major bugfixes
    • onion services: Prevent a race condition (boo#1275918, CVE-2026-77638)
    • client: no longer assert and exit if an onion service encodes an all-zero public key for one of its introduction points
    • directory authorities: Stop allowing 0 as a port in exit policy lines
    • security, conflux: Fix a use-after-free (and potential double free) (boo#1275919, CVE-2026-77587, TROVE-2026-026)

• Update to 0.4.9.10

  • Major bugfixes
    • conflux, security: Reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. (boo#1275920, CVE-2026-77584, TROVE-2026-025)
    • client: Resume warning about unsafe socks protocols when SafeSocks is not set. Also resume warning every time when TestSocks is set.
    • Make clients more consistently expire entry guards 48 to 60 days after they are first used.