Technology · Torproject
Torproject Tor vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 14 vulnerabilities in Torproject Tor: 0 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-87724, was published on 9 September 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 8
- Critical, all time
- 0
- Exploited in the wild
- 0
About Torproject Tor
Tor is a software project that enables anonymous communication over a network.
Latest Torproject Tor vulnerabilities
- CVE-2026-87724: Tor CC_RESPONSE extension denial of service in circuit handshakemediumCVSS 6.5EPSS 0.4%
- CVE-2026-77642: Tor out-of-bounds write in signature parsinghighCVSS 7.5EPSS 0.4%
- CVE-2026-77641: Tor use-after-free in CONFLUX_SWITCH cell handlingmediumCVSS 6.5EPSS 0.4%
- CVE-2026-77640: Tor infinite loop in zlib/gzip decompressionlowCVSS 3.7EPSS 0.4%
- CVE-2026-77639: Tor compression bomb bypass in gzip/zlib stream handlingmediumCVSS 5.3EPSS 0.4%
- CVE-2026-77638: Tor race condition in onion service rendezvoushighCVSS 8.9EPSS 0.3%
- CVE-2026-77587: Tor use-after-free in conflux object recoverymediumCVSS 5.9EPSS 0.4%
- CVE-2026-77584: Tor use-after-free in CONFLUX_LINK cell handlinghighCVSS 7EPSS 0.3%
- CVE-2026-44603: Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.lowCVSS 3.7EPSS 0.3%
- CVE-2026-44602: Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.lowCVSS 3.7EPSS 0.3%
- CVE-2026-44601: Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close…lowCVSS 3.7EPSS 0.3%
- CVE-2026-44600: Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka…lowCVSS 3.7EPSS 0.4%
- CVE-2026-44599: Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.lowCVSS 3.7EPSS 0.3%
- CVE-2026-44597: Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload…lowCVSS 3.7EPSS 0.4%
Most severe Torproject Tor vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-77638: Tor race condition in onion service rendezvoushighCVSS 8.9EPSS 0.3%
- CVE-2026-77642: Tor out-of-bounds write in signature parsinghighCVSS 7.5EPSS 0.4%
- CVE-2026-77584: Tor use-after-free in CONFLUX_LINK cell handlinghighCVSS 7EPSS 0.3%
- CVE-2026-87724: Tor CC_RESPONSE extension denial of service in circuit handshakemediumCVSS 6.5EPSS 0.4%
- CVE-2026-77641: Tor use-after-free in CONFLUX_SWITCH cell handlingmediumCVSS 6.5EPSS 0.4%
- CVE-2026-77587: Tor use-after-free in conflux object recoverymediumCVSS 5.9EPSS 0.4%
- CVE-2026-77639: Tor compression bomb bypass in gzip/zlib stream handlingmediumCVSS 5.3EPSS 0.4%
- CVE-2026-44597: Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload…lowCVSS 3.7EPSS 0.4%
- CVE-2026-77640: Tor infinite loop in zlib/gzip decompressionlowCVSS 3.7EPSS 0.4%
- CVE-2026-44600: Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka…lowCVSS 3.7EPSS 0.4%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 7 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Torproject Tor vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/tor)<a href="https://junglewise.ai/threats/technologies/tor"><img src="https://junglewise.ai/threats/technologies/tor/badge.svg" alt="Torproject Tor vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/tor.json, and this page as text at https://junglewise.ai/threats/technologies/tor.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Torproject Tor vulnerabilities", https://junglewise.ai/threats/technologies/tor, 9 November 2026.