# CVE-2026-77638: Tor race condition in onion service rendezvous

Source: https://junglewise.ai/threats/cve-2026-77638-tor-race-condition-in-onion-service-rendezvous  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77638 · Severity: high · CVSS 8.9 · Published 2026-08-20

Tor, a widely-used anonymity network and software, contains a race condition in its onion service (hidden service) protocol that could allow a rendezvous point to impersonate the intended destination and intercept communications. An attacker controlling a rendezvous point under specific timing conditions could perform a man-in-the-middle attack, compromising the privacy and security that users rely on Tor to provide. This affects users connecting to onion services, potentially exposing their communications to eavesdropping.

Technologies: [Torproject Tor](https://junglewise.ai/threats/technologies/tor). Vendors: [Torproject](https://junglewise.ai/threats/vendors/torproject).

## Quick answers

**Is CVE-2026-77638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77638 being exploited in the wild.

**How severe is CVE-2026-77638?** High severity, with a CVSS score of 8.9, published 20 August 2026.

**Which products and versions are affected?** Tor Project Tor before 0.4.9.11.

**Is there a fix for CVE-2026-77638?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77638 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77638?** Check whether you run Torproject Tor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a race condition in Tor's v3 onion service rendezvous protocol. The flaw occurs when a rendezvous point (the meeting point between client and service) processes connection establishment in a way that allows insufficient validation of the service's identity under concurrent conditions. An attacker controlling or monitoring a rendezvous point can exploit this timing window to impersonate the target onion service before proper authentication is completed. The attack requires network-level access to the rendezvous point and knowledge of the target service address, but does not require authentication. The vulnerability is fixed in Tor 0.4.9.11 and later versions.

## Affected products

- Tor Project Tor before 0.4.9.11

## Timeline

- 2026-08-20: disclosed

## References

- [https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog](https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog)

## Related threats

- [Tor out-of-bounds write in signature parsing](https://junglewise.ai/threats/cve-2026-77642-tor-out-of-bounds-write-in-signature-parsing)
- [Tor use-after-free in CONFLUX_SWITCH cell handling](https://junglewise.ai/threats/cve-2026-77641-tor-use-after-free-in-conflux-switch-cell-handling)
- [Tor infinite loop in zlib/gzip decompression](https://junglewise.ai/threats/cve-2026-77640-tor-infinite-loop-in-zlib-gzip-decompression)
- [Tor compression bomb bypass in gzip/zlib stream handling](https://junglewise.ai/threats/cve-2026-77639-tor-compression-bomb-bypass-in-gzip-zlib-stream-handling)
- [Tor use-after-free in conflux object recovery](https://junglewise.ai/threats/cve-2026-77587-tor-use-after-free-in-conflux-object-recovery)