CVE-2026-77584

NameCVE-2026-77584
DescriptionTor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6372-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tor (PTS)bullseye (security), bullseye0.4.5.16-1vulnerable
bookworm, bookworm (security)0.4.9.11-0+deb12u1vulnerable
trixie (security), trixie0.4.9.11-0+deb13u1fixed
forky, sid0.4.9.11-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
torsourcebullseye(unfixed)end-of-life
torsourcetrixie0.4.9.11-0+deb13u1DSA-6372-1
torsource(unstable)0.4.9.11-1

Notes

[bullseye] - tor <end-of-life> (see DSA 5562)
https://gitlab.torproject.org/tpo/core/tor/-/work_items/41258 (private ATM)

Search for package or bug name: Reporting problems