CyberRota Analysis
AI-GeneratedTor versions prior to 0.4.9.9 are susceptible to a NULL write after free vulnerability that occurs when sending a CONFLUX_SWITCH cell fails, leading to potential crashes. The failure to handle the return value from relay_send_command_from_edge() allows for undetected send failures, which can compromise the stability of the application. Organizations utilizing Tor should prioritize this issue to mitigate potential disruptions in service.
Original NVD Description
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.
Related CVEs
Other vulnerabilities affecting the same vendor(s)