# openSUSE-SU-2026:20589-1: Security update for tor

> Remote attackers can cause a denial of service via memory corruption flaws in the Tor network software, requiring an upgrade to the latest version.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 20 Apr 2026

## What is openSUSE-SU-2026:20589-1?

openSUSE-SU-2026:20589-1 is a memory corruption vulnerability in tor, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

This update for tor fixes the following issues:

Changes in tor:

- update to 0.4.8.23:
  * Fix a memory compare using the wrong length. This could lead to
    a remote crash when using the conflux subsystem
    (TROVE-2026-004, boo#1262302)
  * Fix a series of defense in depth security issues found across
    the codebase
  * Regenerate fallback directories generated on March 25, 2026.
  * Update the geoip files to match the IPFire Location Database,
    as retrieved on 2026/03/25.
- includes changes from 0.4.8.22:
  * Avoid an out-of-bounds read error that could occur with
    V1-formatted EXTEND cells
    (TROVE-2025-016, boo#1262301)
  * Allow old clients to fetch the consensus even if they use
    version 0 of the SENDME protocol
  * Do not check for compression bombs for buffers smaller than
    5MB (increased from 64 KB)
  * Improvements to directory server statistics

- update to 0.4.8.21:
  * This release is a continuation of the previous one and
    addresses additional Conflux-related issues identified through
    further testing and feedback from relay operators. We strongly
    recommend upgrading as soon as possible.
  * Major bugfixes (conflux, exit):
    - When dequeuing out-of-order conflux cells, the circuit
    could be close in between two dequeue which could lead to a
    mishandling of a NULL pointer. Fixes bug 41162;
  * Add -mbranch-protection=standard for arm64.
  * Regenerate fallback directories generated on November
  * Update the geoip files to match the IPFire Location
    Database, as retrieved on 2025/11/17.
  * Fix a bug causing the initial tor process to hang
    intead of exiting with RunAsDaemon, when pluggable transports
    are used.

- 0.4.8.20
  * Add a new hardening compiler flag -fcf-protection=full
  * Fix the root cause of some conflux fragile asserts
  * Fix a series of conflux edge cases

- 0.4.8.19
  * Fix some clients not being able to connect to LibreSSL relays
  * Improve stream flow control performance

## Which versions are affected by openSUSE-SU-2026:20589-1?


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `tor` | openSUSE:Leap 16.0 | All versions | 0.4.8.23-bp160.1.1 |

## How do I fix openSUSE-SU-2026:20589-1?

Upgrade to a fixed version.

## Is openSUSE-SU-2026:20589-1 being exploited?

There is no known exploitation of openSUSE-SU-2026:20589-1 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for openSUSE-SU-2026:20589-1 and fix it if it is affected.

What it is: openSUSE-SU-2026:20589-1 is a memory corruption vulnerability in tor, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of openSUSE-SU-2026:20589-1 in the wild and no public exploit code.

Affected product: tor. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/openSUSE-SU-2026-20589-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2026-20589-1/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/openSUSE-SU-2026:20589-1

---
From sbomify Insights: https://insights.sbomify.com/openSUSE-SU-2026-20589-1/
Summaries are generated and may contain mistakes; the official description above is the record.