Executive brief
Tor is free software that enables anonymous internet communication. This vulnerability allows a malicious user to crash Tor clients by sending specially crafted network commands on an existing connection, potentially disrupting anonymous communication sessions. A successful attack requires no authentication and could lead to denial of service for affected users.
Technical details
The vulnerability is a use-after-free (UAF) flaw in Tor's circuit management code. The root cause is that Tor does not properly reject CONFLUX_LINK cells arriving on circuits that already have attached streams. An attacker can send a RELAY_COMMAND_BEGIN message before CONFLUX_LINK on the same circuit, creating an orphan exit stream with a dangling circuit back-pointer. When the circuit is subsequently freed, the dangling pointer causes a use-after-free condition, potentially leading to memory corruption or crashes. The attack is network-accessible and requires no prior authentication. Tor versions before 0.4.9.10 are affected; users should upgrade immediately.
Affected products
- Tor Project Tor before 0.4.9.10
Timeline
- 2026-08-20: disclosed