Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-77587: Tor <0.4.9.11 can be crashed by malicious exit node
CVE-2026-77587 · published 2 months ago
Summary
Versions of Tor earlier than 0.4.9.11 may let a hostile exit relay cause the software to stop working, potentially closing the browser or other applications that use Tor. The issue occurs when Tor tries to reuse internal data that has already been released, leading to a crash. Update Tor to version 0.4.9.11 or later, or apply any patches provided by your Linux distribution, to prevent the crash.
What to do
- Update debian tor to version 0.4.9.11-0+deb13u1.
- Update debian tor to version 0.4.9.11-1.
- Update debian tor to version 0.4.9.11-0+deb12u1.
- Update torproject tor to version 0.4.9.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | torproject | tor | < 0.4.9.11 |
| Ubuntu:Pro:14.04:LTS | canonical | tor | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | tor | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | tor | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | tor | All versions |
| Ubuntu:22.04:LTS | canonical | tor | All versions |
| Ubuntu:24.04:LTS | canonical | tor | All versions |
| Ubuntu:26.04:LTS | canonical | tor | All versions |
| Debian:11 | debian | tor | All versions |
| Debian:12 | debian | tor |
< 0.4.9.11-0+deb12u1 Fix: upgrade to 0.4.9.11-0+deb12u1
|
| Debian:13 | debian | tor |
< 0.4.9.11-0+deb13u1 Fix: upgrade to 0.4.9.11-0+deb13u1
|
| Debian:14 | debian | tor |
< 0.4.9.11-1 Fix: upgrade to 0.4.9.11-1
|
Original advisory text
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious...
Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.
References
- https://security-tracker.debian.org/tracker/CVE-2026-77587 Vendor Advisory
- https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.11/ChangeLog URL
- https://ubuntu.com/security/CVE-2026-77587 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-77587 Third Party Advisory
- https://gitlab.torproject.org/tpo/core/tor/-/work_items/41306 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77587... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77587 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-911Improper Update of Reference Count
CWE-416Use After Free
Timeline
Published20 Aug 2026
Updated4 Nov 2026
First seen20 Aug 2026
Sources
CVE-2026-77587 · NVD
CVE-2026-77587 · MITRE
DEBIAN-CVE-2026-77587 · OSV
UBUNTU-CVE-2026-77587 · OSV
CVE-2026-77587 · OSV
Track software like this
Free during beta