Executive brief
Tor is anonymity software used to route internet traffic securely. A flaw in Tor before version 0.4.9.9 allows the application to crash when sending a specific type of network cell fails. An attacker can trigger this crash, disrupting the relay's availability and potentially affecting users who depend on that relay for anonymous routing.
Technical details
The vulnerability is a use-after-free in Tor's conflux (multiplexed circuit) handling. When relay_send_command_from_edge() fails to send a CONFLUX_SWITCH cell, its return value is ignored by the caller. This causes the send failure—which internally calls circuit_mark_for_close() and removes the current leg via cfx_del_leg()—to go undetected. The caller then writes to the now-freed leg structure, resulting in a NULL write and crash. The attack requires network reachability to a Tor relay and can be triggered by sending a malformed CONFLUX_SWITCH cell or inducing a send failure condition.
Affected products
- Tor Project Tor before 0.4.9.9
Timeline
- 2026-08-20: disclosed