EUVD-2026-63593
GHSA-9mf5-x83c-fg2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOperate malicious Tor exit node
-
DeliveryVictim conflux circuit uses exit
-
ExploitManipulate conflux legs to revive closed set
-
ExecutionTrigger use-after-free of conflux object
-
ImpactCrash Tor client (DoS)
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires the attacker to operate a malicious Tor exit node that the victim client's circuit uses, and requires the client to be using conflux (multipath) circuits so that a recovery leg can revive a conflux set whose last linked leg has already been closed. The victim must be running an affected Tor version (0.4.8.1-alpha up to but not including 0.4.9.11). Limiting factors: the attacker cannot pick which clients route through their exit (Tor path selection is probabilistic), the specific conflux leg state must be reached, and the impact is limited to crashing the client (no code execution or data exposure confirmed). |
| Impact | This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH) is availability-only: a use-after-free / potential double-free of a conflux object that lets a malicious exit node crash a Tor client. There is no confidentiality or integrity impact (C:N/I:N), so despite the 'HIGH' label the practical worst case is a client denial-of-service, not code execution or data compromise - CWE-911 (improper release of a reference) supports the crash-oriented characterization. Supporting signals reinforce a moderate-not-urgent posture: EPSS is 0.22% (13th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced. No SSVC decision block was provided in the input. One nuance the raw CVSS understates: exploitation is not truly 'anonymous internet' - the attacker must operate a Tor exit node that the victim's circuit happens to use (or force circuit conditions), which is achievable but a meaningful prerequisite that CVSS PR:N does not express. Net: a real, patch-worthy reliability/availability bug (a memory-safety UAF that could in theory be more than a crash), but currently no evidence of active or widespread exploitation. |
| Exploit ScenarioDerived | An attacker runs a malicious Tor exit node and waits for or induces a client to build a conflux (multipath) circuit through it. By manipulating conflux legs so a recovery leg revives a conflux set whose last linked leg has already been closed, the exit triggers a use-after-free (and possible double-free) of the conflux object, crashing the victim's Tor client. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Use-after-free in Tor's conflux (multipath) circuit implementation lets a malicious exit node crash affected Tor clients. When a conflux recovery leg revives a conflux set whose last linked leg has already been closed, the object's reference count is mishandled, producing a use-after-free and potential double free (TROVE-2026-026). Exploitation requires the victim to run Tor 0.4.8.1-alpha through 0.4.9.11, to have conflux/multipath circuits active, and to route a circuit through the attacker's exit node, so attacker success is probabilistic; impact is limited to denial of service with no code execution or data exposure confirmed. No public exploit code was identified at time of analysis, EPSS is 0.22% (13th percentile), and the issue is not listed in CISA KEV.
Earlier versions of this analysis (1)
Use-after-free and potential double-free in Tor's conflux subsystem before version 0.4.9.11 enables a malicious exit node to crash Tor clients by triggering memory corruption during circuit recovery. The defect activates when a recovery leg attempts to revive a conflux set whose last linked leg has already been deallocated, resulting in access to freed memory and a possible second free of the same object. No public exploit is identified at time of analysis, but exploitation requires only that an attacker control a malicious exit node within the Tor network, a non-trivial but achievable position for motivated threat actors.
RemediationAI
Vendor-released patch: upgrade to Tor 0.4.9.11 or later, which contains the conflux reference-counting fix announced in the project's ChangeLog (https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog); see the CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-77587 for tracking. If immediate upgrade of all clients is not possible, the only meaningful compensating control is to remove the affected code path by disabling conflux/multipath circuits where the deployed build exposes a conflux toggle - the trade-off is loss of the multipath performance and load-balancing benefits, plus potentially reduced resilience if a single circuit leg degrades. There is no server-side or network-edge mitigation that reliably blocks this, because the malformed condition originates inside an otherwise valid Tor protocol exchange with a client-selected exit; blocking or pinning exits does not help, since path selection is probabilistic and any exit may be hostile, and running a client without conflux is the practical stopgap until patched. Prioritize patching on user endpoints and any automated Tor client fleets where a crash is operationally disruptive, and monitor for repeated unexplained Tor client terminations as a possible indicator of exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tor's conflux feature (multipath onion circuits) links two or more circuit legs into a single logical set and merges their streams, relying on reference counting to decide when all legs and the associated conflux object can be torn down. CWE-911 (Improper Update of Reference Count) describes the root cause here: during conflux recovery, a recovery leg can revive a conflux set whose last linked leg has already been closed, so the refcount no longer reflects the true number of live references and the conflux object is freed while still referenced - yielding a use-after-free and, if the stale reference is released again, a double free. The consequence is a client-side crash (memory-safety DoS), which is consistent with the C:N/I:N/A:H vector and with the affected CPE cpe:2.3:a:torproject:tor, i.e. the Tor client daemon itself rather than a relay-side component. The published NVD vector rates this 7.5 with AC:L, but AC:H better reflects the assessed conditions: the attacker must operate an exit node the victim actually selects, and the specific conflux leg state (last linked leg already closed, then revived by a recovery leg) must be reached, neither of which the attacker fully controls.
Know when Tor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote network reach with no victim authentication (PR:N), but AC:H because the attacker must control an exit node in the victim's conflux circuit and drive a specific leg-recovery state; impact is availability-only (crash).
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.
Executive ViewAI
A use-after-free flaw in Tor's conflux multipath circuit implementation allows a malicious Tor exit node to crash Tor clients running releases 0.4.8.1-alpha through 0.4.9.11 whenever conflux/multipath circuits are in use. The practical effect is localized denial of service for staff, researchers, or automated services relying on Tor for anonymity or circumvention, with no evidence of code execution, data exposure, or active exploitation. Leadership should care because the affected population is anyone in the organization depending on Tor for sensitive or restricted-network access, and remediation is a straightforward version upgrade rather than an architectural change.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered whe
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Rendezvous-point impersonation in Tor before 0.4.9.11 lets a malicious relay that a client happens to select as its rend
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor
Use-after-free in Tor's conflux circuit handling allows a malicious Tor client to corrupt relay memory by sending a RELA
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
Exploit-DB