CVE-2026-77584
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed.
Risk Assessment
A malicious client could cause a crash or potentially execute arbitrary code in the Tor process, compromising network stability and security.
Recommendation
Upgrade Tor to version 0.4.9.10 or later.
Other vulnerabilities in Tor
See all- CVE-2016-1254High
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
- CVE-2017-8823High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free vulnerability in onion service v2 during intro-point expiration due to mismanagement of the expiring list in certain error cases.
- CVE-2017-8821High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password, triggering an attempt by the OpenSSL library to ask the user for the password.
- CVE-2017-8820High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service via a NULL pointer dereference, leading to application crash.
- CVE-2017-8819High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services. An attacker can send many INTRODUCE2 cells to trigger this issue.
- CVE-2017-0377High
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay, not the exit relay's family. This may allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
- CVE-2017-0375High
The hidden-service feature in Tor before version 0.3.0.8 allows a denial of service (assertion failure and daemon exit) via a malformed BEGIN cell.
- CVE-2016-8860High
Tor versions before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had functions that expected buf_t data to be NUL terminated. The implementation in or/buffers.c did not ensure this termination, allowing remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.
- CVE-2026-77642High
Tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities.
- CVE-2026-77641Medium
Tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. Ignoring the return value of relay_send_command_from_edge() leads to a crash.
Original NVD description (English source)
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.