3448 matches found
CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...
CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...
CVE-2026-49996 securedrop-proxy origin limitation can be bypassed with redirects
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
CVE-2026-77641: Unchecked Return Value
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge was ignored, so a send failure which calls circuitmarkforclose and removes the leg via cfxdelleg would go undetected, causing the caller to write to the...
CVE-2026-77640: Improper Validation of Specified Quantity in Input
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...
CVE-2026-77639: Unprotected Alternate Channel
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77587: Improper Update of Reference Count
Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...
CVE-2026-77584: Incorrect Synchronization
Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...
PT-2026-79133
Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.9.11 Description A use-after-free and potential double free issue occurs involving a conflux object. This happens when a recovery leg revives a conflux set where the last linked leg has already been closed. A maliciou...
PT-2026-79114
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
CVE-2026-77642: Out-of-bounds Write
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...
Chameleon: Robust Defense against Tor Website Fingerprinting Via Many-To-Many Traffic Morphing
Website fingerprinting WF attacks can infer users' browsing activities from encrypted Tor traffic by exploiting side-channel features. Although many WF defenses have been proposed, we find that most existing defenses create learnable web trace mapping features. We further show that robustness...
PT-2026-79149
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
PT-2026-79150
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z STREAM END, causing zlib to return Z BUF ERROR with no input remaining, which buf add compress mistook for a full output buffer and retried forever. Fix...
PT-2026-79219
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...
PT-2026-79132
Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.9.10 Description The software fails to reject a CONFLUX LINK cell when it arrives on a circuit that already has attached streams. A malicious client can send a RELAY COMMAND BEGIN before the CONFLUX LINK on the same...
PT-2026-79148
Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.4.9.11 Description A race condition exists that allows a rendezvous point to impersonate the onion service a client is attempting to reach, potentially enabling a man-in-the-middle attack. Recommendations Update to...
PT-2026-79151
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX SWITCH cell fails. The return value of relay send command from edge was ignored, so a send failure which calls circuit mark for close and removes the leg via cfx del leg would go undetected, causing the caller to write...
CVE-2026-77638: Concurrent Execution using Shared Resource with Improper Synchronization
Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle impersonate the onion service that the client was trying to reach...
