CVE-2026-77584 is a high severity (CVSS 7.0) use-after-free in Tor before 0.4.9.10, tracked as TROVE-2026-025. A client could send a conflux link cell on a circuit that already had streams. The fix is Tor 0.4.9.10, and later releases in the series add further security fixes.
What's affected
Tor versions before 0.4.9.10. Fixed in 0.4.9.10. The Tor ChangeLog says the bug was introduced in 0.4.8.1-alpha, the series that added conflux, and lists the fix under major bugfixes.
Date note: the ChangeLog dates 0.4.9.10 to 23 June 2026, while the CVE record was published on 20 August 2026. The two agree on the fix version; the gap is just publication timing.
The ChangeLog for 0.4.9.11 calls itself a security release that followed quickly because of more high-priority issues, so do not stop at 0.4.9.10 if you can take the newest release.
How to check if you're exposed
Run the binary and read the version.
tor --version
If Tor comes from your distribution, also ask the package manager for the installed version, since backports can carry fixes under older version numbers. Relay operators should check their relay's reported version in their monitoring. If you ship Tor inside another application, such as a browser bundle or an appliance, check the bundled tor version and the vendor's notes.
What to do now
- Upgrade Tor to 0.4.9.10 or later. Prefer the latest 0.4.9.x release in the ChangeLog you can obtain, which is 0.4.9.11 or newer.
- Relay and exit operators should prioritise this, since the attacker in this case is a client talking to the relay.
- If you embed Tor, ask the vendor for a build that includes these fixes and verify the tor version it reports.
- Restart the service after upgrading and confirm the new version with tor --version.
Why it matters
The weakness is classed as CWE-821, incorrect synchronization, in the NVD record. In plain terms, conflux lets one logical connection use several circuits. The code that links two circuits did not reject a link request on a circuit that already carried streams. A client could attach an exit stream first, and when the circuit was later freed the stream kept a dangling pointer back to it.
A use-after-free means memory is used after release. The ChangeLog states the result as a use-after-free and does not describe code execution, so the realistic floor is a crash of the relay, with memory corruption as the class risk. The record does not mark this as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Who can trigger this?
The ChangeLog says a malicious client, so someone who can open a circuit through the relay.
Is 0.4.9.10 enough?
It fixes this CVE. The next release fixes more security issues, so move to the newest you can.
Sources
Last reviewed: 18 October 2026.
