{"id":"CVE-2024-35313","aliases":["EUVD-2024-1571","GHSA-9328-gcfq-p269","GHSA-c96h-cxx6-rmg9","RUSTSEC-2024-0339","RUSTSEC-2024-0340","TROVE-2024-003","TROVE-2024-004"],"status":"published","title":"Tor path lengths too short when \"full Vanguards\" configured","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00298,"percentile":0.22682,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-130","CWE-670","CWE-754"],"published":"2024-05-15T12:00:00Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"crates.io","package":"tor-circmgr","fixed_in":["0.18.1"],"sources":["ghsa"]},{"ecosystem":"crates.io","package":"arti","fixed_in":["1.2.3"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"tor-circmgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0"},{"last_affected":"0.18.0"},{"fixed":"0.18.1"}]}],"versions":["0.18.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"arti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"last_affected":"1.2.2"},{"fixed":"1.2.3"}]}],"versions":["1.2.2"]},{"source":"osv","ecosystem":"crates.io","package":"arti","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.2"},{"fixed":"1.2.3"}]}],"versions":["1.2.2"],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"tor-circmgr","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.1"}]}],"versions":["0.18.0"],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"tor-circmgr","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.1"}]}],"versions":["0.18.0"],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"arti","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.2"},{"fixed":"1.2.3"}]}],"versions":["1.2.2"],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"tor-circmgr","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"crates.io","package":"tor-circmgr","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.1"}]}],"bundled":2}],"references":[{"url":"https://gitlab.torproject.org/tpo/core/arti/-/issues/1400","tags":["x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35313","tags":["advisory"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CHANGELOG.md#arti-123-15-may-2024","tags":["web"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/commit/1a89d5c9659d799a84dd3ff00fae530f5c8ba280","tags":["web"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/issues/1409","tags":["report","web"]},{"url":"https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0339.html","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0340.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c96h-cxx6-rmg9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35312.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35312","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35313.json","tags":["advisory"]},{"url":"https://gitlab.torproject.org/tpo/core/arti","tags":["package"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/commit/da95138c14f762c706e46e89c6adfa46fcd5252c","tags":["web"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2145","tags":["web"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2154","tags":["web"]},{"url":"https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/2156","tags":["web"]},{"url":"https://crates.io/crates/tor-circmgr","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-35313","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","status":"published","published":"2024-05-17T21:29:58.041Z","modified":"2025-03-27T14:31:51.015Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-1571","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","status":"published","published":"2024-05-17T21:29:58Z","modified":"2025-03-27T14:31:51Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:49.948923Z"}],"ghsa":[{"id":"GHSA-c96h-cxx6-rmg9","title":"Tor path lengths too short when \"full Vanguards\" configured","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","status":"published","published":"2024-05-18T00:30:42Z","modified":"2025-03-27T18:40:07Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-130","CWE-754"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2024-35313","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","status":"published","published":"2024-05-17T22:15:07.453Z","modified":"2026-06-17T07:34:44.45Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:10:01.327642Z"}],"osv":[{"id":"CVE-2024-35312","description":"In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.","status":"published","published":"2024-05-17T21:29:25.481Z","modified":"2026-10-28T02:30:26.457756979Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"CVE-2024-35313","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","status":"published","published":"2024-05-17T21:29:58.041Z","modified":"2026-10-28T02:31:07.042547284Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-9328-gcfq-p269","title":"Tor Arti's STUB circuits incorrectly have a length of 2","description":"In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.","status":"published","published":"2024-05-18T00:30:42Z","modified":"2024-11-04T21:30:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-670","CWE-754"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"GHSA-c96h-cxx6-rmg9","title":"Tor path lengths too short when \"full Vanguards\" configured","description":"In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.","status":"published","published":"2024-05-18T00:30:42Z","modified":"2025-03-27T18:40:05Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-130","CWE-754"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"RUSTSEC-2024-0339","title":"Tor path lengths too short when \"Vanguards lite\" configured","description":"## Description\n\nWhen building anonymizing circuits to or from an onion service with \n'lite' vanguards (the default) enabled, \nthe circuit manager code would build the circuits with one hop too few.\n\n## Impact\n\nThis makes users of this code more vulnerable to some kinds of traffic analysis\nwhen they run or visit onion services.\n\n## Vulnerable configurations and use cases\n\nArti configured with \"vangaurds lite\" is vulnerable;\nthis is the default.\n\nOnly users who make connections to Onion Services\n(Tor Hidden Services) are affected.\nNote, however, that when used as a browser proxy,\nmalicious web pages can typically make such connections.\n\n## Mitigation\n\nEnable the \"full vanguards\" feature.\nThis has some cost in terms of performance, reliability,\nand impact on the Tor Network.\n\n(Arti configured with \"full vanguards\" has a similar bug,\nTROVE-2024-04,\nso this will not deliver the full incressed security of \"full vanguards\";\nbut the security level of affected versions of Arti\nconfigured with \"full vanguards\" still exceeds\nthe intended security level of the \"vanguards lite\" configuration.)\n\nAlternatively,\npreventing access to Tor Hidden Services will avoid the problem,\nwith corresponding loss of functionality.\nThis can be achieved in the Arti configuration file with:\n\n```\n[address_filter]\nallow_onion_addrs = false\n```\n\n## Resolution\n\nRebuild `arti` (or other affected applications)\nwith a fixed version of `tor-circmgr`:\n0.18.1 or later.\n\nThe fixed `tor-circmgr` is on crates.io and available in\n[the upstream git repository](https://gitlab.torproject.org/tpo/core/arti)\nat signed tag `arti-v1.2.3`.\n\n### Note about older versions\n\nEven though earlier versions are classified as \"not affected\",\nthis is because in those versions the Vanguards feature\nis experimental, or absent.\nDowngrading worsens security, rather than improving it.\n\n## References\n\n * [arti#1409](https://gitlab.torproject.org/tpo/core/arti/-/issues/1409):\n   the ticket in the Arti bugtracker.\n * [TROVE](https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE)\n   Tor Project vulnerability database.\n * [arti#1400](https://gitlab.torproject.org/tpo/core/arti/-/issues/1400):\n   the similar bug with the full vanguards feature.","status":"published","published":"2024-05-15T12:00:00Z","modified":"2026-02-04T02:58:07.410619Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"RUSTSEC-2024-0340","title":"Tor path lengths too short when \"full Vanguards\" configured","description":"## Description\n\nWhen building anonymizing circuits to or from an onion service with \nfull vanguards enabled, \nthe circuit manager code would build the circuits with one hop too few.\n\n## Impact\n\nThis makes users of this code more vulnerable to some kinds of traffic analysis\nwhen they run or visit onion services.\n\n## Vulnerable configurations and use cases\n\nArti configured with \"full vangaurds\" is vulnerable.\n\nOnly users who make connections to Onion Services\n(Tor Hidden Services) are affected.\nNote, however, that when used as a browser proxy,\nmalicious web pages can typically make such connections.\n\n## Mitigation\n\nPreventing access to Tor Hidden Services will avoid the problem,\nwith corresponding loss of functionality.\nThis can be achieved in the Arti configuration file with:\n\n```\n[address_filter]\nallow_onion_addrs = false\n```\n\nChanging the configuration (eg to turn off vanguards)\nreclassifies the behaviour as \"as configured\",\nbut reduces security rather than improving it,\nso is not a mitigation.\n\n## Resolution\n\nRebuild `arti` (or other affected applications)\nwith a fixed version of `tor-circmgr`:\n0.18.1 or later.\n\nThe fixed `tor-circmgr` is on crates.io and available in\n[the upstream git repository](https://gitlab.torproject.org/tpo/core/arti)\nat signed tag `arti-v1.2.3`.\n\n### Note about older versions\n\nEven though earlier versions are classified as \"not affected\",\nthis is because in those versions the Vanguards feature\nis experimental, or absent.\nDowngrading worsens security, rather than improving it.\n\n## References\n\n * [arti#1400](https://gitlab.torproject.org/tpo/core/arti/-/issues/1400):\n   the ticket in the Arti bugtracker.\n * [TROVE](https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE)\n   Tor Project vulnerability database.\n * [arti#1409](https://gitlab.torproject.org/tpo/core/arti/-/issues/1409):\n   the similar bug with the vanguards lite feature.","status":"published","published":"2024-05-15T12:00:00Z","modified":"2026-02-04T02:29:53.583773Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}