VDB
CVE-2026-77638
CVE-2026-77638
PUBLISHED
CVSS 8.9 HIGH
Reported by mitre · Published August 20, 2026
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.
Risk Scores
CVSS 3.1
8.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| torproject | Tor | 0.3.5.3-alpha |
| torproject | tor | 0.3.5.3-alpha, 0.3.5.3-alpha |
| torproject | Tor | 0.3.5.3-alpha, 0.3.5.3-alpha |
Timeline
- Aug 20, 2026 CVE Published
- Aug 21, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 27, 2026 CVE Updated
- Sep 3, 2026 Security Advisory
- Sep 5, 2026 EPSS Score
- Sep 15, 2026 EPSS Score
- Sep 17, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score