# CVE-2026-77584: Tor use-after-free in CONFLUX_LINK cell handling

Source: https://junglewise.ai/threats/cve-2026-77584-tor-use-after-free-in-conflux-link-cell-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77584 · Severity: high · CVSS 7 · Published 2026-08-20

Tor is free software that enables anonymous internet communication. This vulnerability allows a malicious user to crash Tor clients by sending specially crafted network commands on an existing connection, potentially disrupting anonymous communication sessions. A successful attack requires no authentication and could lead to denial of service for affected users.

Technologies: [Torproject Tor](https://junglewise.ai/threats/technologies/tor). Vendors: [Torproject](https://junglewise.ai/threats/vendors/torproject).

## Quick answers

**Is CVE-2026-77584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77584 being exploited in the wild.

**How severe is CVE-2026-77584?** High severity, with a CVSS score of 7, published 20 August 2026.

**Which products and versions are affected?** Tor Project Tor before 0.4.9.10.

**Is there a fix for CVE-2026-77584?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77584 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77584?** Check whether you run Torproject Tor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free (UAF) flaw in Tor's circuit management code. The root cause is that Tor does not properly reject CONFLUX_LINK cells arriving on circuits that already have attached streams. An attacker can send a RELAY_COMMAND_BEGIN message before CONFLUX_LINK on the same circuit, creating an orphan exit stream with a dangling circuit back-pointer. When the circuit is subsequently freed, the dangling pointer causes a use-after-free condition, potentially leading to memory corruption or crashes. The attack is network-accessible and requires no prior authentication. Tor versions before 0.4.9.10 are affected; users should upgrade immediately.

## Affected products

- Tor Project Tor before 0.4.9.10

## Timeline

- 2026-08-20: disclosed

## References

- [https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.10/ChangeLog](https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.10/ChangeLog)

## Related threats

- [Tor out-of-bounds write in signature parsing](https://junglewise.ai/threats/cve-2026-77642-tor-out-of-bounds-write-in-signature-parsing)
- [Tor use-after-free in CONFLUX_SWITCH cell handling](https://junglewise.ai/threats/cve-2026-77641-tor-use-after-free-in-conflux-switch-cell-handling)
- [Tor infinite loop in zlib/gzip decompression](https://junglewise.ai/threats/cve-2026-77640-tor-infinite-loop-in-zlib-gzip-decompression)
- [Tor compression bomb bypass in gzip/zlib stream handling](https://junglewise.ai/threats/cve-2026-77639-tor-compression-bomb-bypass-in-gzip-zlib-stream-handling)
- [Tor race condition in onion service rendezvous](https://junglewise.ai/threats/cve-2026-77638-tor-race-condition-in-onion-service-rendezvous)