---
id: CVE-2026-77584
title: >-
  Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a
  circuit which already has attached streams
summary: >-
  Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a
  circuit which already has attached streams. A malicious client could send a
  RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an
  exit strea…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-821
vendor: torproject
product: tor
affected:
  - tor < 0.4.9.10
patched:
  - tor 0.4.9.10
published: '2026-08-20'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T14:15:12.163'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77584'
references:
  - url: 'https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.10/ChangeLog'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.0025
epssPercentile: 0.14477
ingestedAt: '2026-09-16T14:57:28.001Z'
---

## Overview

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.

## Affected

- `tor < 0.4.9.10`

## Remediation

Upgrade past the affected range:

- `tor 0.4.9.10`