SUSE · Security update for tor
Affects SUSESource GCVE Database
Rated by Threat Radar
Data as of 26 Oct 2026, 16:19 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SUSE Product Security Team SUSE | Affected
| Fixed in– |
AI-suggested
Users and administrators should update to Tor version 0.4.9.9 or later to apply these important security and stability fixes. The update addresses multiple critical bugs and should be applied promptly to avoid potential crashes and memory safety issues. No additional mitigations are indicated beyond applying this official update.
Description
This security update for Tor addresses multiple major bugfixes related to compression, security, client stability, and memory safety. Key fixes include resolving a compression bomb bypass, preventing infinite loops during decompression of truncated streams, fixing use-after-free and NULL pointer dereference issues, and avoiding out-of-bounds reads/writes when parsing signatures. Additional fixes improve client stability against malicious onion services, prevent crashes related to DNSPort requests, and address potential divide-by-zero crashes in onion services with proof-of-work enabled. These fixes cover bugs introduced in various alpha versions dating back to 0.2.0.1-alpha and up to 0.4.8.1-alpha. The update is part of Tor version 0.4.9.9.