CVE-2026-77638 is a high severity (CVSS 8.9) race condition in Tor before 0.4.9.11. In the right circumstances, a rendezvous point could act as a man-in-the-middle and impersonate the onion service a client tried to reach. Upgrade Tor to 0.4.9.11 or later.
What's affected
- Product: Tor (torproject).
- Affected: versions before 0.4.9.11.
- Fixed: 0.4.9.11, per the Tor ChangeLog named in the record. The ChangeLog page would not load for me, so read it for details.
- Weakness: CWE-362, race condition.
- CVSS 8.9 (high). Not listed in CISA KEV.
How to check if you're exposed
Check the Tor version on every host that runs Tor as a client, relay or onion service.
tor --version
On Debian or Ubuntu you can also check the packaged version.
apt policy tor
Tor Browser bundles its own Tor, so update the browser through its normal updater. Distribution packages often lag the upstream release, so check the package changelog for the fix.
What to do now
- Find every Tor client, relay and onion service you run.
- Upgrade to Tor 0.4.9.11 or later, from the Tor Project repository or your distribution when it ships the fix.
- Update Tor Browser installs through the browser updater.
- If you run onion services, check your relay and service logs for odd rendezvous behaviour around the time of the upgrade.
Why it matters
A race condition means two events happen in an order the code did not expect. The record says that, in just the right circumstances, a rendezvous point could impersonate the onion service the client wanted to reach. Onion services rely on that rendezvous step, so a break there touches the authenticity of the connection.
The Tor ChangeLog is the primary source for the exact conditions. Operators should take the upgrade and not rely on guesses about how hard the timing is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix it?
The record says Tor before 0.4.9.11 is affected, so 0.4.9.11 or later.
Does Tor Browser need an update?
Tor Browser ships its own Tor. Update it through its updater and check the release notes.
Sources
Last reviewed: 19 October 2026.
