A flaw in Tor versions before 0.4.9.7 causes the client to crash when a circuit queue experiences memory pressure, due to a double close of a circuit. This weakness, classified as CWE‑837, results in an unstable client that can be forced to terminate. The crash is not a data‑exposure flaw, but it denies service and may interrupt anonymity operations.

The vulnerability affects the Tor client produced by TorProject. Any installation using a Tor version prior to 0.4.9.7 is vulnerable. No specific hardware or operating‑system restrictions are noted.

The CVSS score of 3.7 indicates a low severity risk. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves creating conditions that generate memory pressure in the circuit queue, which could be achieved by flooding the client with high‑volume traffic or manipulating circuit establishment timing. While the impact is limited to client crashes, repeated outages could degrade user experience and trust in anonymity.