CVE-2026-77641

Tor versions before 0.4.9.9 ignore the return value of relay_send_command_from_edge() when sending a CONFLUX_SWITCH cell; on send failure, the circuit leg is freed via cfx_del_leg() while the caller still writes to it, causing a NULL write-after-free crash (TROVE-2026-017). The fix is included in...