RUSTSEC-2024-0340: Tor path lengths too short when "full Vanguards" configured

What to do

1. See which version you have: cargo tree -i tor-circmgr (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p tor-circmgr. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example tor-circmgr = "0.18.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Description

When building anonymizing circuits to or from an onion service with full vanguards enabled, the circuit manager code would build the circuits with one hop too few.

Impact

This makes users of this code more vulnerable to some kinds of traffic analysis when they run or visit onion services.

Vulnerable configurations and use cases

Arti configured with "full vangaurds" is vulnerable.

Only users who make connections to Onion Services (Tor Hidden Services) are affected. Note, however, that when used as a browser proxy, malicious web pages can typically make such connections.

Mitigation

Preventing access to Tor Hidden Services will avoid the problem, with corresponding loss of functionality. This can be achieved in the Arti configuration file with:

[address_filter]
allow_onion_addrs = false

Changing the configuration (eg to turn off vanguards) reclassifies the behaviour as "as configured", but reduces security rather than improving it, so is not a mitigation.

Resolution

Rebuild arti (or other affected applications) with a fixed version of tor-circmgr: 0.18.1 or later.

The fixed tor-circmgr is on crates.io and available in the upstream git repository at signed tag arti-v1.2.3.

Note about older versions

Even though earlier versions are classified as "not affected", this is because in those versions the Vanguards feature is experimental, or absent. Downgrading worsens security, rather than improving it.

References

• arti#1400: the ticket in the Arti bugtracker.
• TROVE Tor Project vulnerability database.
• arti#1409: the similar bug with the vanguards lite feature.

References

• Package: crates.io/crates/tor-circmgr
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0340.html
• Report: gitlab.torproject.org/tpo/core/arti/-/issues/1409

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for tor-circmgr

• VulnerabilityRUSTSEC-2024-0339 · 2024-05-15Tor path lengths too short when "Vanguards lite" configured

Full security history of tor-circmgr