This isn’t a recommendation to update. Many people stay on 0.3.5.1 for good reasons (JAM, fidelity bonds). The post just collects the facts so everyone can judge their own risk.
What happened
The cause of the missing protocols: Desc=3 Microdesc=3 error: with Tor 0.4.9.15 (10-28), the directory authorities started requiring newer protocol versions. Every client on Tor 0.4.8 or older then quit on startup, and that includes the Tor in StartOS 0.3.5.x.
On 11-04 the Tor Project released 0.4.9.16, an emergency fix for the directory authorities only, which undoes that requirement (https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.16/ReleaseNotes). I checked the current network consensus (2026-11-07 06:00 UTC), and it only requires Desc=2 Microdesc=2 again:
consensus-method 38
required-client-protocols Cons=2 Desc=2 FlowCtrl=1 Link=4 Microdesc=2 Relay=2
On 0.3.5.1: restart the affected services (or the whole server) and check the Tor logs. The “missing protocols” error should be gone.
Sparrow users who saw the same error on 0.4.x: that was Sparrow’s own built-in Tor. Sparrow 2.5.6 fixes it.
Good to know: this is only temporary
Tor 0.4.8 has been end-of-life since June ( Sunsetting Tor 0.4.8 – Please update to 0.4.9 by September | The Tor Project ) and the Tor Project still plans to retire it from the network for good. When that happens, the same error will probably come back.
Good to know: the base system doesn’t get updates
StartOS 0.3.5.1 came out in November 2023 and is built on Debian 12 regular security support for bookworm on 2026-07-12( Debian -- News -- Security support for Bookworm handed over to the LTS team ) (LTS continues until 2028-06-30). On StartOS that hardly matters, because the system is a fixed image: Debian
fixes never reach a 0.3.5.1 box, and 0.3.5.1 is the last 0.3.x relefectively frozen at its November 2023 state.
A few of the publicly known flaws fixed since then:
- OpenSSH “regreSSHion” (CVE-2024-6387 (https://security-tracker.de6387)): remote code execution as root in sshd without login. Debianfixed it in July 2024; 0.3.5.1 still has the old OpenSSH 9.2p1. Exploiting it is hard in practice.
- glibc (CVE-2023-6246 (https://security-tracker.debian.org/tracker2961 ( CVE-2024-2961 )):privilege escalation and memory corruption in the C library that almost every program uses.
- Linux kernel: two years of kernel fixes are missing, including thr-free CVE-2026-98432( CVE-2026-98432 ) (fixed upstream in 6.1.190 and later).
- APT (CVE-2026-109518 (https://security-tracker.debian.org/trackeracker who can tamper with traffic to the package mirror can get rootduring apt install (fixed in bookworm with APT 2.6.2). That’s relevant if you follow workarounds that run apt install on the box.
- Tor 0.4.8.9 itself: every fix since then is missing, including ths own TROVE advisories in later 0.4.8.x releases.
How exposed you are depends on your setup. Most StartOS boxes sit only reachable on the LAN, and many of these flaws need localaccess or a specific situation. A box that isn’t reachable from the internet carries much less risk than one with open ports.
It’s also worth looking at Start9’s security status page (Security status | Start9). It shows that Start9 takes security seriously: recent flaws are listed with a severity and status for each product, from the Linux kernel to OpenSSH to individual services. But the fixes listed there only arrive with 0.4.x releases, and 0.3.5.x doesn’t appear on the page. A “not affected” there applies to current versions, not automatically to 0.3.5.1.