Tor 0.4.9.12 patches high-severity UAFs and drops TAP keys

The Tor Project has issued version 0.4.9.12 as a security release, fixing several high-severity bugs that include use-after-free errors under memory pressure and a pair of issues that could let hostile caches or local configuration choices corrupt client state.

The most serious class of flaws stemmed from how Tor handled out-of-memory conditions deep in the circuit queue code. Previously the process could free objects at unexpected points in the call stack, creating use-after-free risks. The new release moves OOM handling higher in the stack so that low-level paths only detect the condition. Related problems could let a malicious directory cache convince a client that certain relay descriptors were unusable, and a separate use-after-free could be triggered when AutomapHostsOnResolve was enabled, especially with IPv4 or small virtual address ranges. Consensus-diff sizes are now capped to blunt memory-exhaustion denial-of-service attacks.

In addition to the memory-safety work, clients and relays are urged to adopt newer protocol versions. Directory authorities will no longer accept relay descriptors that still contain TAP keys, so every relay must move to a current 0.4.9.x stable release or risk being excluded from the network. The project also corrected circuit cryptography negotiation so that congestion-control-aware hop cryptography is offered to every supporting hop rather than only the final one.

Tor describes the release as containing multiple high-security fixes and strongly recommends that operators upgrade as soon as possible. The issues are tracked under TROVE-2026-043, TROVE-2026-034, TROVE-2026-036 and TROVE-2026-042.