EUVD-2026-63591
GHSA-j5c4-cwjr-6vv5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Network-reachable by any Tor client (AV:N, PR:N) but AC:H for required cell-ordering timing; I:H for heap UAF corruption potential; A:L as crashes are not the primary described outcome.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
AnalysisAI
Use-after-free in Tor's conflux circuit multiplexing implementation allows a malicious Tor client to corrupt relay process memory by exploiting improper enforcement of cell ordering. All Tor releases from 0.4.8.1-alpha through 0.4.9.9 are affected: an attacker sends a RELAY_COMMAND_BEGIN cell before a CONFLUX_LINK cell on the same circuit, creating an orphaned exit stream with a dangling back-pointer that triggers a UAF when the circuit is freed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable code path is active on any Tor relay or exit node running 0.4.8.1-alpha through 0.4.9.9 with the conflux feature present - which is the default for these versions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.0 High score reflects genuine risk: AV:N means any Internet-accessible Tor relay can be reached by a malicious client without authentication (PR:N, UI:N), while I:H signals potential for heap memory corruption that could exceed simple information disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious Tor client initiates a circuit to a vulnerable relay running Tor before 0.4.9.10, sends a RELAY_COMMAND_BEGIN cell to attach an exit stream, then immediately sends a CONFLUX_LINK cell on the same circuit before the relay has enforced stream-attachment state. The exit stream is orphaned, leaving a dangling back-pointer; when the circuit is subsequently torn down, the relay dereferences freed memory, yielding a use-after-free condition that may enable heap corruption or, under favorable memory layout, code execution. … |
| Remediation | Upgrade to Tor 0.4.9.10, which contains the fix rejecting CONFLUX_LINK cells on circuits that already have attached streams. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Tor deployments running releases 0.4.8.1-alpha through 0.4.9.9. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Same weakness CWE-821 – Incorrect Synchronization
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today