CVE-2026-77584
7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Summary
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| torproject | Tor | 0.4.8.1-alpha < 0.4.9.10 | affected |
Weaknesses
- CWE-821: CWE-821 Incorrect Synchronization
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.