CVE-2026-77641

Tor versions before 0.4.9.9 ignore the return value of relay_send_command_from_edge() when sending a CONFLUX_SWITCH cell; on send failure, the circuit leg is freed via cfx_del_leg() while the caller still writes to it, causing a NULL write-after-free crash (TROVE-2026-017). The fix is included in...

PT-2026-79151

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX SWITCH cell fails. The return value of relay send command from edge was ignored, so a send failure which calls circuit mark for close and removes the leg via cfx del leg would go undetected, causing the caller to write...