CVE-2026-77638

Tor can use a temporary meeting point to connect a visitor with an onion service. In rare circumstances, a dishonest meeting point can pose as the intended service—like an impostor answering the door of a business your staff meant to visit—and read or alter what passes through it.

This matters to you if your business uses Tor to access or run onion services. It is a risk only when an attacker controls the relay used as the connection’s meeting point and wins a narrow timing race during setup.

An attacker would need to operate the connection’s meeting relay and exploit a precise timing window, which makes this an amber-priority update rather than an active emergency. There is no record of known public exploit code or confirmed real-world exploitation, but the possible interception and impersonation warrant scheduling the update promptly.

Confirm exposure by identifying Tor installations used by systems that access or host onion services, then check each installed version with the platform’s package inventory or tor --version.

Upgrade affected installations to 0.4.9.11 or later. The findings provide one fixed release and do not identify separate maintenance branches or upgrade-breaking changes; use the normal upgrade method for the operating system or Tor distribution in use.

No vendor-documented temporary workaround is provided in the findings. If an upgrade must be delayed, avoid using affected systems for sensitive onion-service activity where practical, and prioritize systems handling credentials, payments, or confidential business communications.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date. Track Tor Project release notices and investigate unexpected identity, certificate, or content changes when connecting to important onion services.

CVSS 3.1 score: 8.9 High (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L). The issue is CWE-362, a race condition in rendezvous establishment: a malicious rendezvous point can impersonate the onion service and man-in-the-middle the connection. Exploitation requires control of a rendezvous point plus specific timing. EPSS is 0.2% (9th percentile) and flat. The CVE is not in CISA KEV, and no public exploit code is on record; exploit maturity is therefore not publicly established.