EUVD-2026-63591
GHSA-j5c4-cwjr-6vv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen Tor circuit to target relay
-
DeliverySend RELAY_COMMAND_BEGIN to attach exit stream
-
ExploitSend CONFLUX_LINK on same circuit
-
ExecutionOrphan stream leaves dangling back-pointer
-
PersistCircuit free triggers use-after-free
-
ImpactRelay memory corruption / crash
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that the target run a vulnerable Tor build (0.4.8.1-alpha up to but not including 0.4.9.10) with conflux support, and that the attacker act as a Tor client able to reach the node and construct a circuit. The specific trigger is protocol-ordering: sending a RELAY_COMMAND_BEGIN (attaching an exit stream) before a CONFLUX_LINK cell on the same circuit, which pre-patch Tor fails to reject. No authentication, no user interaction, and no non-default configuration beyond normal conflux-capable relay operation are needed; the main limiting factor is that upgrading to 0.4.9.10 fully removes the condition by rejecting CONFLUX_LINK on circuits that already have attached streams. |
| Impact | This is a genuine memory-safety defect (use-after-free) in Tor's conflux circuit handling, reachable remotely and pre-authentication since any client can open a Tor circuit. The vendor CVSS of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) is driven mainly by I:H, reflecting memory corruption of the relay process; C:N and A:L are notable, indicating the vendor does not view this as a confidentiality or full-availability event. Counter-signals temper urgency: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing (no public exploitation identified at time of analysis), and no POC is referenced - only a changelog and advisory. There is a tension worth flagging: the input Tags label this 'Information Disclosure,' which contradicts the CVSS vector (C:N means no confidentiality impact) - this is a memory-corruption/integrity bug, not information disclosure. A further nuance is that UAF-on-free typically manifests first as a relay crash, so real-world impact may skew more toward availability (denial of service against a relay/exit) than the vendor's A:L suggests; whether it is weaponizable into code execution is not established in the provided data. Net: a real, patch-worthy issue for relay operators, but current exploitation-probability signals are low, making it an important-but-not-emergency prioritization pending patch rollout. |
| Exploit ScenarioDerived | A malicious Tor client builds a circuit to a target relay/exit, sends a RELAY_COMMAND_BEGIN to attach an exit stream, then sends a CONFLUX_LINK cell on the same already-streamed circuit, which older Tor fails to reject. The orphaned stream leaves a dangling circuit back-pointer, and when the circuit is later freed the use-after-free corrupts relay memory, most likely crashing the process. No POC is referenced in the available intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Use-after-free in Tor's conflux circuit handling allows a malicious Tor client to corrupt relay memory by sending a RELAY_COMMAND_BEGIN (attaching an exit stream) before a CONFLUX_LINK cell on the same circuit; vulnerable Tor builds fail to reject that ordering, leaving an orphaned exit stream and a dangling circuit back-pointer that is dereferenced when the circuit is freed. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, meaning the attack is remote and unauthenticated with high integrity impact and limited availability impact, and exploitation only requires a conflux-capable build in the 0.4.8.1-alpha through pre-0.4.9.10 range plus the ability to reach the node and build a circuit. No public exploit code has been identified at time of analysis and EPSS is low at 0.18% (7th percentile), but the vendor has released a fix in Tor 0.4.9.10, and the low EPSS reflects limited attention rather than any mitigation on unpatched nodes. This is TROVE-2026-025.
Earlier versions of this analysis (1)
Use-after-free in Tor's conflux circuit multiplexing implementation allows a malicious Tor client to corrupt relay process memory by exploiting improper enforcement of cell ordering. All Tor releases from 0.4.8.1-alpha through 0.4.9.9 are affected: an attacker sends a RELAY_COMMAND_BEGIN cell before a CONFLUX_LINK cell on the same circuit, creating an orphaned exit stream with a dangling back-pointer that triggers a UAF when the circuit is freed. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the network-reachable UAF with High integrity impact warrants prompt patching for all relay and exit node operators.
RemediationAI
Vendor-released patch: upgrade Tor to 0.4.9.10 or later, which removes the condition by rejecting a CONFLUX_LINK cell on any circuit that already has attached streams; the upstream fix is documented in the 0.4.9.10 ChangeLog at https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.10/ChangeLog, with advisory details at https://nvd.nist.gov/vuln/detail/CVE-2026-77584 and https://vuldb.com/vuln/393869. Deployments that bundle Tor (for example Tor Browser distributions) should move to a bundle built on 0.4.9.10 or later rather than relying on downstream builds of the vulnerable branch. Because exploitation requires a conflux-capable build, operators who cannot upgrade immediately should treat any configuration that disables or prevents conflux negotiation as a temporary exposure reduction - but note the trade-off that disabling conflux forfeits its latency and resilience benefits and, depending on how the setting is applied, may be overridden by newer network consensus parameters; downgrading below the 0.4.8.1-alpha series would also remove the vulnerable code path but is not recommended since it abandons unrelated fixes and may break network compatibility. There is no reliable configuration-level filter for the malicious cell sequence, so patch deployment is the only complete remediation; per EPSS 0.18% (7th percentile) no exploitation has been observed publicly, and there is no indication of an in-the-wild campaign, so prioritization can follow normal patch cycles for conflux-capable nodes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Conflux is Tor's multi-path circuit mechanism, added in the 0.4.8.1-alpha series, which joins two independently built circuits into a linked set using a CONFLUX_LINK cell so traffic can be split across paths. Streams are normally attached to a circuit with RELAY_COMMAND_BEGIN, and Tor's circuit state machine assumes a defined ordering between these operations. The defect is classified CWE-821 (Incorrect Synchronization): the pre-0.4.9.10 code did not validate that a CONFLUX_LINK cell arriving on a circuit already carrying attached streams should be rejected, so a client that interleaves BEGIN before CONFLUX_LINK creates a stream that is later orphaned while the circuit retains a back-pointer into freed circuit state. When the circuit is torn down, that stale pointer is dereferenced, producing a use-after-free - a memory-safety condition consistent with the assessed high integrity impact (C:N/I:H/A:L) rather than a mere denial of service. The affected product identifier is cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*, i.e. the Tor daemon itself, covering all builds in the vulnerable conflux range; the code path is in the relay/circuit layer rather than in onion-service or directory handling, so ordinary relays and clients running a vulnerable build that negotiate conflux are the relevant exposure surface.
Know when Tor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Any unauthenticated client can send crafted cells over the network (AV:N/AC:L/PR:N/UI:N); UAF corrupts relay memory (I:H) with likely crash impact (A:L) and no data disclosure (C:N).
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
Executive ViewAI
A memory-safety flaw in Tor 0.4.8.1-alpha through builds prior to 0.4.9.10 lets any remote, unauthenticated party that can reach a relay and build a circuit corrupt that relay's memory by manipulating Conflux circuit setup. Relays operated by our organization - and the anonymity and routing integrity they provide to downstream users and partners - are the direct exposure, since a compromised relay can be coerced into serving manipulated traffic. A vendor fix is already published, so this is a manageable patch-debt item, but unpatched nodes remain fully exposed until upgraded.
Apply vendor patch (Tor 0.4.9.10); interim, restrict relay reachability where operationally feasible and disable Conflux on any node that cannot be upgraded immediately.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered whe
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Rendezvous-point impersonation in Tor before 0.4.9.11 lets a malicious relay that a client happens to select as its rend
Write-after-free in Tor's conflux (traffic-splitting) subsystem allows a remote unauthenticated attacker to crash a Tor
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
Exploit-DB