EUVD-2026-63658
GHSA-r3c6-fj5w-6f75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach target Tor relay OR port
-
DeliveryNegotiate conflux-capable circuit
-
ExploitTear down connection during CONFLUX_SWITCH send
-
Installrelay_send_command_from_edge() returns error undetected
-
C2cfx_del_leg() frees current leg pointer
-
ExecuteCaller writes to freed leg
-
ImpactTor process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Return value checking
|
| Exploitation Conditions | The conflux (traffic-splitting) feature must be active on the targeted Tor instance - this feature was introduced in the 0.4.8.x alpha series and is enabled by default in qualifying builds. The attacker must be able to establish a circuit with conflux negotiated and then engineer a condition where the CONFLUX_SWITCH send fails, which requires timing the connection teardown to race with the switch operation. No authentication is required (PR:N); the attacker only needs network reachability to the Tor relay's OR port or the ability to be a circuit peer. Exploitation is limited to Tor versions 0.4.8.1-alpha through 0.4.9.8 and does not affect relays or clients where conflux is disabled or unavailable. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H scores 8.2, reflecting a remotely triggerable crash with no authentication required. The I:L metric is debatable - the write to freed memory is a NULL-equivalent write causing a crash rather than meaningful data corruption, making I:N more accurate in practice. A:H is well-supported: the crash terminates the Tor process entirely. EPSS at 0.19% (9th percentile) is very low, indicating minimal observed exploitation pressure. The vulnerability is not in CISA KEV and no public exploit code has been identified. Despite the high CVSS, real-world risk is moderated by: (1) the conflux feature being relatively new and not universally used in all circuit paths, (2) low EPSS, and (3) impact being purely DoS with no confidentiality or meaningful integrity loss. However, for Tor relays (especially guards and exits) and hidden service operators, a remotely triggerable crash without authentication is a meaningful operational risk, particularly for availability-critical infrastructure. The fix is available in 0.4.9.9 and should be applied promptly for relay operators. |
| Exploit ScenarioDerived | A remote attacker - requiring no account or authentication - establishes a connection to a Tor relay running a vulnerable version and negotiates a conflux-capable circuit. The attacker then arranges for a CONFLUX_SWITCH cell to be sent under conditions that cause relay_send_command_from_edge() to fail (e.g., by closing the underlying connection at the right moment), triggering the ignored-return-value code path. The relay's Tor process dereferences the freed leg pointer, writes to freed heap memory, and crashes - taking the relay offline and disrupting any circuits it was serving. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 08, 2026
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor relay or client by triggering a failed CONFLUX_SWITCH cell send. The root cause is CWE-252: the return value of relay_send_command_from_edge() is silently ignored - a send failure that internally marks the circuit for close and deallocates the active conflux leg goes undetected, leaving the caller to write through the now-freed leg pointer. The result is a NULL write to freed heap memory and an immediate process crash. No public exploit code exists and EPSS is very low (0.19%), but the attack is unauthenticated, low-complexity, and network-reachable, making it a realistic DoS primitive against any Tor node running 0.4.8.1-alpha through 0.4.9.8.
Earlier versions of this analysis (1)
Use-after-free crash in Tor's conflux traffic-splitting code allows a remote unauthenticated attacker (per CVSS:3.1/AV:N/PR:N) to crash a Tor relay or client by triggering a CONFLUX_SWITCH cell send failure. The root cause is an unchecked return value from relay_send_command_from_edge(): when the send fails, the circuit is torn down and the leg freed via cfx_del_leg(), but the caller proceeds to write to that now-freed memory, causing a NULL write-after-free and process crash. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the high-complexity exploitation bar (AC:H) is the primary limiting factor rather than any authentication gate.
RemediationAI
Upgrade to Tor 0.4.9.9, which contains the fix for TROVE-2026-017 as confirmed by the upstream ChangeLog (https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog). Relay operators should prioritize this upgrade since they are reachable by arbitrary remote peers without authentication. If immediate upgrade is not possible, a compensating control is to disable the conflux feature if the Tor version supports a configuration toggle for it - this removes the vulnerable code path entirely, at the cost of reduced throughput on circuits that would benefit from traffic splitting. Check the Tor Project's official documentation for the relevant torrc directive. Clients that use Tor via Tor Browser should update to the version bundling Tor 0.4.9.9 or later.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tor's conflux feature (introduced in the 0.4.8.x alpha series) allows traffic to be split across multiple circuit legs for improved throughput and censorship resistance. Internally, each active circuit can have a 'current leg' pointer within a conflux (cfx) context. When the code attempts to switch legs by sending a CONFLUX_SWITCH cell via relay_send_command_from_edge(), that function can fail - triggering circuit_mark_for_close() internally, which in turn calls cfx_del_leg() to free and remove the leg from the conflux structure. Because the caller does not check the return value (CWE-252: Unchecked Return Value), it proceeds to dereference and write through the pointer to the now-freed leg object, producing a use-after-free write (effectively writing NULL or zeroing fields in freed heap memory). The affected CPE is cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*, specifically versions 0.4.8.1-alpha through 0.4.9.8. This is formally tracked as TROVE-2026-017.
Know when Tor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Write-after-free causes process crash only; NULL write to freed memory does not constitute meaningful integrity impact, so I:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.
Executive ViewAI
Tor versions 0.4.8.1-alpha through 0.4.9.8 are vulnerable to remote denial-of-service attacks from unauthenticated attackers that crash relays and clients. Organizations relying on Tor infrastructure must apply available patches to prevent service disruptions affecting anonymous communications operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered whe
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Rendezvous-point impersonation in Tor before 0.4.9.11 lets a malicious relay that a client happens to select as its rend
Use-after-free in Tor's conflux circuit handling allows a malicious Tor client to corrupt relay memory by sending a RELA
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
Exploit-DB