Tor before version 0.4.9.7 mishandles the accounting of the conflux out-of-order queue when clearing it, a flaw identified as TROVE‑2026‑010. This incorrect accounting can leave stale or duplicated entries in the queue, causing the process to stall or process outdated data. The resulting inconsistent state can degrade performance or halt the relay, representing a potential denial of service. The weakness corresponds to CWE‑696, improper use of resources that can lead to incorrect state management.

The vulnerability affects the Tor network client distributed by the Tor Project. All releases before 0.4.9.7 are potentially impacted, while 0.4.9.7 and later include the fix.

The CVSS score of 3.7 indicates a low severity and the absence of an EPSS score or KEV listing suggests that exploitation is unlikely. The likely attack vector is remote via normal Tor traffic, although it may also be triggered by local control over the daemon. The risk profile remains low but should not be ignored for critical deployments.