The Tor Project released version 0.4.9.16 as an emergency update specifically for directory authorities. The release addresses a 'thundering herd' issue caused by new required protover values in the previous release, which was causing older clients to exit. It also includes a workaround for a bug where old clients failed to handle unparseable microdescriptors correctly when TAP keys were omitted.
Why it matters Scope and consequences remain subject to the linked upstream discussion.
Tor developers merged a revert of a recent change that listed multiple protocol capabilities as required. The revert addresses issues causing clients on version 0.4.8.x or lower to get stuck in a restart loop while fetching unusable consensus. This action allows affected clients to rejoin the network and treat microdescriptions as valid.
Why it matters The revert is intended to resolve a network-wide incident where a significant number of clients were unable to connect due to consensus fetching failures.
The Tor Project released version 0.4.9.15, a security update introducing new defenses against large volumes of directory requests. The release makes the HSDir flag sticky across restarts and updates directory authorities to require specific protocol capabilities, rendering Tor versions 0.4.8 and earlier incompatible with the network. Operators are advised to upgrade relays as soon as possible.
Why it matters The release includes critical DoS mitigations for relays and enforces protocol changes that will disconnect older clients from the network.
A security report filed via HackerOne and published on GitLab describes a defect in Arti's rendezvous queue where a client sending no proof-of-work can evict a queued client that did. The report states this defeats the priority queue's purpose but notes it does not demonstrate a sustained denial of service. A maintainer commented that the issue is a bug but does not seem like a DoS issue, and a fix issue was created.
Why it matters The report states that the defect defeats the purpose of the priority queue, allowing clients to bypass proof-of-work requirements for queue admission.
