CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already...
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
CVE-2026-77584- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-821
- Updated
- 2026-11-02
EUVDEUVD-2026-63591
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
EUVD-2026-63591- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j5c4-cwjr-6vv5
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already...
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
GHSA-j5c4-cwjr-6vv5- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-821
- Updated
- 2026-11-02
NVD
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
CVE-2026-77584- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-821
- Updated
- 2026-11-02
OSV
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
CVE-2026-77584- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-821
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
DEBIAN-CVE-2026-77584- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
- Record
UBUNTU-CVE-2026-77584- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
OSVMGASA-2026-0382 No score
Updated tor packages fix security vulnerabilities
An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type (CVE-2026-77642). A NULL write after free when sending a CONFLUX_SWITCH cell fails, resulting in a crash (CVE-2026-77641). An infinite loop when decompressing a truncated zlib/gzip stream with done=1 (CVE-2026-77640). A compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams (CVE-2026-77639). A race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach (CVE-2026-77638). A use-after-free that a malicious exit node could use to crash a client (CVE-2026-77587). Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams (CVE-2026-77584).
- Record
MGASA-2026-0382- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11590-1 No score
tor-0.4.9.11-1.1 on GA media
These are all security issues fixed in the tor-0.4.9.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11590-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21660-1 No score
Security update for tor
This update for tor fixes the following issues:
Changes in tor:
-
Update to 0.4.9.11
- Major bugfixes
- onion services: Prevent a race condition (boo#1275918, CVE-2026-77638)
- client: no longer assert and exit if an onion service encodes an all-zero public key for one of its introduction points
- directory authorities: Stop allowing 0 as a port in exit policy lines
- security, conflux: Fix a use-after-free (and potential double free) (boo#1275919, CVE-2026-77587, TROVE-2026-026)
- Major bugfixes
-
Update to 0.4.9.10
- Major bugfixes
- conflux, security: Reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. (boo#1275920, CVE-2026-77584, TROVE-2026-025)
- client: Resume warning about unsafe socks protocols when SafeSocks is not set. Also resume warning every time when TestSocks is set.
- Make clients more consistently expire entry guards 48 to 60 days after they are first used.
- Major bugfixes
- Record
openSUSE-SU-2026:21660-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
before 0.4.9.11-0+deb12u1, plus listed versions 0.4.7.13-10.4.7.16-10.4.8.10-10.4.8.10-1~bpo11+10.4.8.10-1~bpo12+1 Show 42 moreShow less0.4.8.11-10.4.8.11-1~bpo11+10.4.8.11-1~bpo12+10.4.8.12-10.4.8.12-1.10.4.8.12-1~bpo11+10.4.8.12-1~bpo12+10.4.8.13-10.4.8.13-20.4.8.13-2~bpo12+10.4.8.14-10.4.8.14-1~bpo12+10.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+20.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.8.4-20.4.8.5-10.4.8.6-10.4.8.7-10.4.8.8-10.4.8.9-10.4.8.9-1~bpo11+10.4.8.9-1~bpo12+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb12u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-0+deb12u10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
0.4.9.11-0+deb12u1 |
torDebian:13 |
before 0.4.9.11-0+deb13u1, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 17 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb13u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-0+deb13u10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
0.4.9.11-0+deb13u1 |
torDebian:14 |
before 0.4.9.11-1, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 16 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.11-1~bpo13+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
0.4.9.11-1 |
torMageia:10 From an advisory covering 7 CVEs |
before 0.4.9.11-1.mga10 | 0.4.9.11-1.mga10 |
torMageia:9 From an advisory covering 7 CVEs |
before 0.4.9.11-1.mga9 | 0.4.9.11-1.mga9 |
torUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.2.3.25-10.2.4.19-10.2.4.20-10.2.4.27-1build0.14.04.10.2.4.27-1ubuntu0.10.2.4.27-1ubuntu0.1+esm10.2.4.27-1ubuntu0.1+esm2 |
None known |
torUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.2.6.10-1ubuntu20.2.7.6-1ubuntu10.2.9.11-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.20.2.9.14-1ubuntu1~16.04.30.2.9.14-1ubuntu1~16.04.3+esm1 |
None known |
torUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.3.0.10-10.3.1.8-20.3.1.9-10.3.2.9-10.3.2.9-1build1 Show 4 moreShow less0.3.2.10-10.3.2.10-1ubuntu0.10.3.2.10-1ubuntu0.2~esm10.3.2.10-1ubuntu0.2~esm2 |
None known |
torUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.4.1.5-10.4.1.5-1build10.4.1.6-10.4.2.5-10.4.2.6-10.4.2.7-10.4.2.7-1ubuntu0.1~esm1 |
None known |
torUbuntu:22.04:LTS |
All versions, plus listed versions 0.4.5.9-10.4.6.8-10.4.6.8-1build10.4.6.9-10.4.6.10-10.4.9.11-0ubuntu0.22.04.1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
torUbuntu:24.04:LTS |
All versions, plus listed versions 0.4.8.4-20.4.8.7-10.4.8.9-10.4.8.10-10.4.8.10-1build10.4.8.10-1build20.4.9.11-0ubuntu0.24.04.1 |
None known |
torUbuntu:26.04:LTS |
All versions, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.22-10.4.9.6-10.4.9.11-0ubuntu0.26.04.1 |
None known |
toropenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.4.9.11-1.1 | 0.4.9.11-1.1 |
toropenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 0.4.9.11-bp160.1.1 | 0.4.9.11-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-77584 is a high vulnerability (CVSS 7.0) in Torproject Tor, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in tor 0.4.9.11-0+deb12u1.
References
gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.10/ChangeLog
nvd.nist.gov/vuln/detail/CVE-2026-77584
github.com/advisories/GHSA-j5c4-cwjr-6vv5
security-tracker.debian.org/tracker/CVE-2026-77584
advisories.mageia.org/MGASA-2026-0382.html
Show 12 moreShow less
bugs.mageia.org/show_bug.cgi?id=36213
lists.opensuse.org/archives/list/[email protected]/message/J3OOWWFCIOAR7SCIVWYWCHHV6G2BGSPN
lists.debian.org/debian-security-announce/2026/msg00283.html
ubuntu.com/security/CVE-2026-77584
cve.org/CVERecord?id=CVE-2026-77584
suse.com/security/cve/CVE-2026-77584
bugzilla.suse.com/1275918