CVE-2026-44597Disclosure(torproject / tor)

LOWCVSS 9.1 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

torproject CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://gitlab.torproject.org/tpo/core/tor/-/commit/8f98054b1982d00a14639864d03e9afd90b87481

Vendor / third-party advisories

https://www.openwall.com/lists/oss-security/2026/05/06/8

Other references

Weakness type (CWE)

CWE-684

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

4 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 4 classified signals
4 total mentions across 1 day

Affected systems

Vendors

torproject

Products

tor

Deep dive

Activity timeline4 mentions / 1d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

Infoflowcloud@infoflowcloud154d
Disclosure
🚨*CVE* CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. https://www.cve.org/CVERecord?id=CVE-2026-44597 ----- Traducción: CVE-2026-44597 Tor anterior a 0.4.9.7 tiene un… http://infoflow.cloud`
Post summary
The note announces CVE‑2026‑44597, an out‑of‑bounds read in Tor versions before 0.4.9.7, triggered by END, TRUNCATE, or TRUNCATED cells without a reason, with no PoC, exploit, or patch details provided.
0000031
75 followersView on X
CVE@CVEnew154d
Disclosure
CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. https://www.cve.org/CVERecord?id=CVE-2026-44597
Post summary
The post reports CVE‑2026‑44597, an out‑of‑bounds read in Tor versions earlier than 0.4.9.7 when certain cells lack a reason, and provides a link to the CVE record.
00000135
57.4K followersView on X
CVEarity@CVEarity154d
Disclosure
⚡ New CVE Alert: CVE-2026-44597 📊 Severity: 3.7 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-44597 #CVE-2026-44597 #CVE #Low #CyberSecurity #InfoSec https://t.co/XEWUcYAMcT
Post summary
The tweet simply announces CVE-2026-44597, noting its low severity but providing no further technical details, exploit information, or fix.
0000043
152 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds154d
Disclosure
CVE-2026-44597 Out-of-Bounds Read in Tor Before 0.4.9.7 Cell Payload Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44597
Post summary
The entry announces CVE-2026-44597, an out-of-bounds read flaw in Tor's cell payload processing prior to v0.4.9.7; no PoC, exploit, or patch details are provided.
0000049
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	torproject	tor	-	-	-

Explore more

Back to dashboard torproject CVEs tor vulnerabilities

What researchers are saying

CVE-2026-44597

Infoflowcloud@infoflowcloudDisclosure

The note announces CVE‑2026‑44597, an out‑of‑bounds read in Tor versions before 0.4.9.7, triggered by END, TRUNCATE, or TRUNCATED cells without a reason, with no PoC, exploit, or patch details provided.

CVE@CVEnewDisclosure

The post reports CVE‑2026‑44597, an out‑of‑bounds read in Tor versions earlier than 0.4.9.7 when certain cells lack a reason, and provides a link to the CVE record.

CVEarity@CVEarityDisclosure

The tweet simply announces CVE-2026-44597, noting its low severity but providing no further technical details, exploit information, or fix.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The entry announces CVE-2026-44597, an out-of-bounds read flaw in Tor's cell payload processing prior to v0.4.9.7; no PoC, exploit, or patch details are provided.