Multiple vulnerabilities in Tor, including a high-severity remote code execution flaw, affect all architectures running versions prior to 0.4.9.11. The specific attack vectors and CVSS scores are detailed in the referenced TROVE advisories. The resolution is to upgrade to version 0.4.9.11, as no workaround is currently available.
Multiple vulnerabilities have been found in Tor, the worst of which could allow remote code execution. Affected packages Package net-vpn/tor on all architectures Affected versions < 0.4.9.11 Unaffected versions >= 0.4.9.11 Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description Multiple vulnerabilities have been discovered in Tor. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this time. Resolution All Tor users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-vpn/tor-0.4.9.11" References TROVE-2025-014 TROVE-2025-015 TROVE-2025-016 TROVE-2026-003 TROVE-2026-004 TROVE-2026-006 TROVE-2026-007 TROVE-2026-008 TROVE-2026-009 TROVE-2026-010 TROVE-2026-011 TROVE-2026-013 TROVE-2026-014 TROVE-2026-015 TROVE-2026-017 TROVE-2026-018 TROVE-2026-019 TROVE-2026-020 TROVE-2026-021 TROVE-2026-025 TROVE-2026-026 Release date August 29, 2026 Latest revision August 29, 2026: 1 Severity high Exploitable remote Bugzilla entries 965987 969415 971568 974279 976637 977978 978087