SecurityReported
Tor SOCKS5 CRLF injection vulnerability reported
Published · Updated
A security report describes a CRLF injection vulnerability in the Tor daemon's SOCKS5 server, allowing an unauthenticated client to inject fake control event lines into the controller stream. The issue requires the non-default `AllowNonRFC953Hostnames=1` setting and was reported via HackerOne. A developer comment notes that a basic fix is available in a merge request targeted at the main branch, and the issue is currently closed.
Why it matters
Controllers parsing events line-by-line may become desynchronized and act on forged state transitions if the non-default hostname setting is enabled.
Event status Developing
Read the sources
- SOCKS5 injection gitlab.torproject.org
- Public comment by @arma gitlab.torproject.org
This is an AI-assisted summary of the linked public sources. Consult the original reports for details and operator guidance.