CVE-2026-44600

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://forum.torproject.org/c/news/tor-release-announcement/28	Release Notes
https://gitlab.torproject.org/tpo/core/tor/-/commit/a198185ed863677d60eec120126730628dac35bb	Patch
https://gitlab.torproject.org/tpo/core/tor/-/work_items/41251	Broken Link
https://www.openwall.com/lists/oss-security/2026/05/06/8	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Tor antes de 0.4.9.7 gestiona erróneamente la contabilidad de la cola de confluencia fuera de orden durante el vaciado de una cola, también conocido como TROVE-2026-010.

Information

Published : 2026-05-07 03:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-44600

Mitre link : CVE-2026-44600

CVE.ORG link : CVE-2026-44600

JSON object : View

Products Affected

torproject

tor

CWE

CWE-696

Incorrect Behavior Order

{"id": "CVE-2026-44600", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44600", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T12:46:45.347681Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "torproject", "product": "Tor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.4.9.7", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-07T03:16:08.523", "references": [{"url": "https://forum.torproject.org/c/news/tor-release-announcement/28", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/a198185ed863677d60eec120126730628dac35bb", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://gitlab.torproject.org/tpo/core/tor/-/work_items/41251", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/05/06/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-696"}]}], "descriptions": [{"lang": "en", "value": "Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010."}, {"lang": "es", "value": "Tor antes de 0.4.9.7 gestiona err\u00f3neamente la contabilidad de la cola de confluencia fuera de orden durante el vaciado de una cola, tambi\u00e9n conocido como TROVE-2026-010."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E643A817-85FE-4CEC-BC69-0E2FA22639C0", "versionEndExcluding": "0.4.9.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}