🎯 New Report #3709605: Conflux-queued zero-length RELAY END triggers heap out-of-bounds read
🔺Severity: Medium
👽 Reporter: geeknik
⭐️ Reputation: 5998
🛠 State: resolved
💼 Team: Tor
💵 Bounty: null
🕐 Submitted: 2026-05-02
⏰ Disclosed: 2026-09-10 12:10:35
📝 Summary: A vulnerability was discovered in Tor that could trigger a heap out-of-bounds read when a zero-length RELAY END cell was processed on a non-open AP stream. The vulnerability was caused by the way Tor handles these cells, where the reason byte was read before checking the message length. This issue was compounded by Conflux's out-of-order delivery, which could copy the zero-length message into an exact-size heap allocation, leading to the out-of-bounds read.
📂 Report JSON File: 3709605
@hackeronereports