A security report filed against Tor core identifies a vulnerability where a malformed `.auth_private` file causes Tor to log a near-complete v3 onion-service client-auth private key at WARN level, even when `SafeLogging` is enabled. The report states the issue affects Tor 0.3.5.1-alpha through 0.4.9.11 and the current main branch, with no fixed release identified. Public comments from Tor developers suggest a fix using safe logging.
Why it matters The report indicates that a lower-trust principal with access to Tor logs could obtain a near-complete private key from a malformed credential file, potentially compromising client authorization for v3 onion services.
A relay operator reports a sustained circuit-building DoS against their guard relay family starting June 25, 2026, characterized by an 8x sustained increase in open circuits and a 20x peak. The attack involved millions of near-idle circuits and onionskin processing spikes across multiple regions, with bandwidth increasing only 20%. While DoS defenses engaged and prevented TCP port exhaustion, EU relays shed 10-20% of real traffic due to capacity constraints.
Why it matters The report suggests the pattern is network-wide or family-targeted, and notes that EU relays shed 10-20% of real traffic.
A security report describes a CRLF injection vulnerability in the Tor daemon's SOCKS5 server, allowing an unauthenticated client to inject fake control event lines into the controller stream. The issue requires the non-default `AllowNonRFC953Hostnames=1` setting and was reported via HackerOne. A developer comment notes that a basic fix is available in a merge request targeted at the main branch, and the issue is currently closed.
Why it matters Controllers parsing events line-by-line may become desynchronized and act on forged state transitions if the non-default hostname setting is enabled.
Following a power outage on 2025-10-27, the Tor directory authority maatuska has been reporting substantially fewer relays with Guard flags in its votes compared to the network consensus. While initial reports showed a discrepancy of over 3,000 flags, recent data from November 2026 indicates the gap persists, with maatuska voting for roughly half the Guard relays of other authorities. The issue remains open.
Why it matters Scope and consequences remain subject to the linked upstream discussion.
