Skip to content
Mageia Tor Critical Out-Of-Bounds and Memory Issues Advisory 2026

Mageia Tor Critical Out-Of-Bounds and Memory Issues Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • September 8, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

Description: An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type (CVE-2026-77642). A NULL write after free when sending a CONFLUX_SWITCH cell fails, resulting in a crash (CVE-2026-77641). An infinite loop when decompressing a truncated zlib/gzip stream with done=1 (CVE-2026-77640). A compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams (CVE-2026-77639). A race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach (CVE-2026-77638). A use-after-free that a malicious exit node could use to crash a client (CVE-2026-77587). Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams (CVE-2026-77584).

Description: An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type (CVE-2026-77642). A NULL write after free when sending a CONFLUX_SWITCH cell fails, resulting in a crash (CVE-2026-77641). An infinite loop when decompressing a truncated zlib/gzip stream with done=1 (CVE-2026-77640). A compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams (CVE-2026-77639). A race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach (CVE-2026-77638). A use-after-free that a malicious exit node could use to crash a client (CVE-2026-77587). Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams (CVE-2026-77584).

- - - - - - - - - -

-

-

-

-

-

-

-

-

-

-

- 10/core/tor-0.4.9.11-1.mga10 - 9/core/tor-0.4.9.11-1.mga9

- 10/core/tor-0.4.9.11-1.mga10

- 9/core/tor-0.4.9.11-1.mga9

Publication date: 08 Sep 2026 URL: https: //advisories.mageia.org/MGASA-2026-0382.html Type: security CVE: CVE-2026-77584, CVE-2026-77587, CVE-2026-77638, CVE-2026-77639, CVE-2026-77640, CVE-2026-77641, CVE-2026-77642

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases