Tor Conflux BEGIN_DIR Handling Vulnerability

A vulnerability exists in Tor versions prior to 0.4.9.7, where the application can improperly manage BEGIN_DIR requests through conflux legs. This issue, identified as TROVE-2026-008, can lead to incorrect directory handling in the Tor network.

Impact

Exploitation of this vulnerability can cause improper management of directory requests, potentially disrupting normal Tor operations.

Reproduction

The vulnerability can be reproduced by sending a BEGIN_DIR command through a conflux leg on a relay that is set to accept such commands. This can be done by manipulating the circuit's state to include a conflux link and then sending the BEGIN_DIR command without a proper directory stream context.

Remediation

Users are advised to upgrade to Tor version 0.4.9.7, which addresses this vulnerability by preventing the acceptance or initiation of BEGIN_DIR commands over conflux legs.