EUVD-2026-63593
GHSA-9mf5-x83c-fg2x
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exit-node position and precise timing requirement justify AC:H; pure crash impact with no confidentiality or integrity effect yields C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.
AnalysisAI
Use-after-free and potential double-free in Tor's conflux subsystem before version 0.4.9.11 enables a malicious exit node to crash Tor clients by triggering memory corruption during circuit recovery. The defect activates when a recovery leg attempts to revive a conflux set whose last linked leg has already been deallocated, resulting in access to freed memory and a possible second free of the same object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must operate a malicious Tor exit node - a significant prerequisite that limits the viable attacker pool to actors with resources and intent to run network infrastructure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the bounded impact: availability-only (client crash), high attack complexity due to required timing alignment and the prerequisite of exit-node control, and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An adversary operating a malicious Tor exit node establishes or participates in conflux-enabled multi-leg circuits with a target client, then deliberately closes the last linked conflux leg while engineering a recovery leg to fire shortly after. This triggers the use-after-free on the now-freed conflux object inside the client's Tor process, causing an immediate crash and severing the client's anonymity network connection. … |
| Remediation | Upgrade to Tor 0.4.9.11 or later; this is the vendor-released patch addressing TROVE-2026-026, documented in the official ChangeLog at https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Same weakness CWE-911 – Improper Update of Reference Count
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today