55 matches found
CVE-2026-87724
Tor before 0.4.9.12 interprets the CCRESPONSE extension even when CCREQUEST was not sent, which allows remote attackers to cause a denial of service crash because of corrupted congestion-control state. This is TROVE-2026-032...
EUVD-2026-74539
Tor before 0.4.9.12 interprets the CCRESPONSE extension even when CCREQUEST was not sent, which allows remote attackers to cause a denial of service crash because of corrupted congestion-control state. This is TROVE-2026-032...
EUVD-2026-63665
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...
DEBIAN-CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77641
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge was ignored, so a send failure which calls circuitmarkforclose and removes the leg via cfxdelleg would go undetected, causing the caller to write to the...
CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...
CVE-2026-77642
tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...
CVE-2026-77640
Tor before 0.4.9.9 is vulnerable to a denial of service when decompressing a truncated zlib/gzip stream with done=1. The root cause is in buf_add_compress() : a truncated stream never reaches Z_STREAM_END, so zlib returns Z_BUF_ERROR with no input remaining, which the function misinterpreted as a...
CVE-2026-77640
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...
EUVD-2026-63648
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77639
Tor before 0.4.9.9 is affected by a compression bomb bypass (TROVE-2026-022). An attacker can concatenate many gzip or zlib sub-streams , each individually just under the per-stream detection threshold, to circumvent the compression bomb check entirely. This results in a Denial of Service conditi...
CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...
CVE-2026-77587
Tor before 0.4.9.11 is affected by a use-after-free (and potential double free) in the conflux subsystem. The flaw occurs when a recovery leg revives a conflux set whose last linked leg has already been closed, allowing a malicious exit node to crash a client, resulting in a denial of service (TR...
CVE-2026-77587
Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...
CVE-2026-77587
Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026...
CVE-2026-77584
Tor before 0.4.9.10 fails to reject a CONFLUX_LINK cell on a circuit with attached streams; a malicious client sends RELAY_COMMAND_BEGIN first, orphaning an exit stream that leaves a dangling circuit back-pointer and triggers use-after-free when the circuit is freed. CVSS 3.1 scores 7.0 (HIGH). F...
CVE-2026-77584
Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...
CVE-2026-77640: Improper Validation of Specified Quantity in Input
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...
PT-2026-79151
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX SWITCH cell fails. The return value of relay send command from edge was ignored, so a send failure which calls circuit mark for close and removes the leg via cfx del leg would go undetected, causing the caller to write...