CVE-2026-77587

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog	Permissions Required Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Tor anterior a 0.4.9.11 es propenso a un uso después de liberación (y una posible doble liberación) de un objeto conflux cuando una recovery leg revive un conjunto conflux cuya última linked leg ya ha sido cerrada. Un nodo de salida malicioso podría usar esto para bloquear un cliente. Esto es TROVE-2026-026.

16 Sep 2026, 14:09

Type	Values Removed	Values Added
CPE		cpe:2.3:a:torproject:tor::::::::
CWE		CWE-416
First Time		Torproject tor Torproject
References	~~() https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog -~~	() https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog - Permissions Required, Release Notes, Vendor Advisory

Information

Published : 2026-08-20 21:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-77587

Mitre link : CVE-2026-77587

CVE.ORG link : CVE-2026-77587

JSON object : View

Products Affected

torproject

tor

CWE

CWE-911

Improper Update of Reference Count

CWE-416

Use After Free

{"id": "CVE-2026-77587", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77587", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:08:45.475220Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "torproject", "product": "Tor", "versions": [{"status": "affected", "version": "0.4.8.1-alpha", "lessThan": "0.4.9.11", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T21:17:10.957", "references": [{"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog", "tags": ["Permissions Required", "Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-911"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026."}, {"lang": "es", "value": "Tor anterior a 0.4.9.11 es propenso a un uso despu\u00e9s de liberaci\u00f3n (y una posible doble liberaci\u00f3n) de un objeto conflux cuando una recovery leg revive un conjunto conflux cuya \u00faltima linked leg ya ha sido cerrada. Un nodo de salida malicioso podr\u00eda usar esto para bloquear un cliente. Esto es TROVE-2026-026."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3DEFC03-2093-4083-A3BF-5722FDD62387", "versionEndExcluding": "0.4.9.11"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}