This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-77642 →

DEBIAN-CVE-2026-77642

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact...

Original description

The description as published by the source.

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 tor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.9-1"}]}]

Debian:13 tor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.11-0+deb13u1"}]}]

Debian:14 tor

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.9-1"}]}]

References

advisory security-tracker.debian.org