CVE-2026-77638 is a race condition in Tor's onion service rendezvous point (RP) handshake, patched in version 0.4.9.11. The vulnerability allows a malicious RP to impersonate an onion service to a client, collapsing the mutual anonymity that onion services are designed to provide. The CVSS 8.9 reflects the catastrophic impact if exploited — the RP sits at a concentration point where one successful man-in-the-middle attack breaks anonymity for both endpoints simultaneously. The EPSS of 0.00174 tells a different story: exploitation requires precise timing control and is unlikely to be automated, suggesting a narrow attacker population (likely targeted research or highly motivated adversaries rather than mass exploitation).
Prioritize patching your Tor instances to 0.4.9.11 immediately. However, patching alone doesn't exhaust the exposure surface. The RP handshake is implemented across multiple Tor-derived projects — Orbot, embedded Tor libraries, and historical relay binaries still running in production. Each of these may carry the same timing window without the benefit of this patch. Inventory your Tor-adjacent deployments and confirm vendor patch availability.
The multi-party nature of the remediation is itself a risk factor. Clients, services, and the relay they're meeting at must all be updated for the race condition to be fully mitigated. If your onion service depends on relays you don't control, monitor their versions and consider migrating traffic to updated infrastructure.
One structural question remains unresolved: does the 0.4.9.11 patch introduce a targeted race guard (a lock or reordered operation), or does it fundamentally change when and how the RP authenticates endpoints? If it's the former, treat this as the first patch in a likely series — race guards in timing-sensitive code frequently reveal adjacent edge cases that require follow-on fixes. Track the Tor release notes for 0.4.9.x for subsequent security updates affecting onion service handshakes.