Onion Flash · Protocol

Tor 0.4.9.15 security release adds DoS defenses and drops 0.4.8 support

Wed, 28 Oct 2026 18:31:01 GMT

The Tor Project released version 0.4.9.15, a security update introducing new defenses against large volumes of directory requests. The release makes the HSDir flag sticky across restarts and updates directory authorities to require specific protocol capabilities, rendering Tor versions 0.4.8 and earlier incompatible with the network. Operators are advised to upgrade relays as soon as possible.

Why it matters: The release includes critical DoS mitigations for relays and enforces protocol changes that will disconnect older clients from the network.

Confirmed · Normal priority · Released

tor-0.4.9.15 gitlab.torproject.org
Release of tor 0.4.9.15 and the deployment of a new protocol version at directory authorities. The protocol change causes some clients to repeatedly re-request consensus documents, making them appear gitlab.torproject.org
[tor-announce] [RELEASE] New C-tor 0.4.9.15 lists.torproject.org

Arti reported to have proof-of-work queue bypass allowing zero-effort eviction

Tue, 22 Sep 2026 20:45:02 GMT

A security report filed via HackerOne and published on GitLab describes a defect in Arti's rendezvous queue where a client sending no proof-of-work can evict a queued client that did. The report states this defeats the priority queue's purpose but notes it does not demonstrate a sustained denial of service. A maintainer commented that the issue is a bug but does not seem like a DoS issue, and a fix issue was created.

Why it matters: The report states that the defect defeats the purpose of the priority queue, allowing clients to bypass proof-of-work requirements for queue admission.

Reported · Normal priority · Developing

PoW bypass issue gitlab.torproject.org
Public comment by @wesleyac gitlab.torproject.org
Public comment by @wesleyac gitlab.torproject.org

Tor releases 0.4.9.16 emergency fix for directory authority thundering herd

Wed, 04 Nov 2026 19:53:47 GMT

The Tor Project released version 0.4.9.16 as an emergency update specifically for directory authorities. The release addresses a 'thundering herd' issue caused by new required protover values in the previous release, which was causing older clients to exit. It also includes a workaround for a bug where old clients failed to handle unparseable microdescriptors correctly when TAP keys were omitted.

Why it matters: Scope and consequences remain subject to the linked upstream discussion.

Confirmed · High priority · Released

tor-0.4.9.16 gitlab.torproject.org
[tor-announce] [RELEASE] Tor release 0.4.9.16 lists.torproject.org

Tor developers revert protocol capability change to unstick clients in restart loop

Tue, 03 Nov 2026 14:30:32 GMT

Tor developers merged a revert of a recent change that listed multiple protocol capabilities as required. The revert addresses issues causing clients on version 0.4.8.x or lower to get stuck in a restart loop while fetching unusable consensus. This action allows affected clients to rejoin the network and treat microdescriptions as valid.

Why it matters: The revert is intended to resolve a network-wide incident where a significant number of clients were unable to connect due to consensus fetching failures.

Reported · High priority · Merged

Revert "Authority: List multiple protocol capabilities as "required"." gitlab.torproject.org