Threats Tagged 'cve-2026-77587'

This security update for Tor addresses multiple major bugs including race conditions in onion services, use-after-free vulnerabilities, and protocol handling issues. The fixes prevent potential crashes and improve security by correcting how introduction points and exit policies are handled. The update also restores warnings for unsafe SOCKS protocols and improves client entry guard expiration consistency.

CVE-2026-77584 is a high-severity vulnerability in Tor before version 0.4.9.10 involving incorrect synchronization. The flaw allows a malicious client to send a RELAY_COMMAND_BEGIN before a CONFLUX_LINK on the same circuit, causing an exit stream to become orphaned and leading to a use-after-free condition when the circuit is freed. This can impact the integrity and availability of the Tor process.

A vulnerability in Tor versions before 0.4.9.9 allows an attacker to bypass the compression bomb detection by concatenating multiple gzip or zlib sub-streams, each below the detection threshold. This flaw can lead to denial of service by causing resource exhaustion. The issue is tracked as CVE-2026-77639 and is classified under CWE-420 (Unprotected Alternate Channel).

Tor versions before 0.4.9.11 contain a use-after-free vulnerability related to improper update of reference counts in conflux objects. This flaw occurs when a recovery leg revives a conflux set whose last linked leg has already been closed, potentially leading to a crash of the client. The vulnerability has a medium severity rating with a CVSS score of 5.9.