Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.
{
"cna_assigner": "mitre",
"cwe_ids": [
"CWE-837"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44601.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.4.9.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "d4e3f6a440b58c2be661decf20c09548704907dc"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44601.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"111836470109952031034058059183798678039",
"251340779394189550759230082084885324625",
"107545899884167734753563939736675646121"
],
"threshold": 0.9
},
"id": "CVE-2026-44601-132f51a4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.torproject.org/tpo/core/tor@d4e3f6a440b58c2be661decf20c09548704907dc",
"target": {
"file": "src/core/or/circuitlist.c"
}
}
]
"2026-10-28T11:10:57Z"