CVE-2026-44603
Low · 3.7CVSS
3.7
EPSS
0.6%
Published
May 7, 2026
CISA due date
—
The record
Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | tor | 0 | 0.4.9.8-1.1 |
Related vulnerabilities
- CVE-2026-44601 Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client… Also affects tor
- CVE-2026-44602 Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of… Also affects tor
- CVE-2026-44600 Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the… Also affects tor
- CVE-2026-44599 Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008. Also affects tor
- CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell… Also affects tor
- CVE-2014-0160 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… Also affects tor
- CVE-2011-4576 The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not… Also affects tor
- CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in… CWE-193