EUVD-2026-63648
GHSA-jm5p-g55h-rwhg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable unauthenticated attack with no special conditions; availability impact capped at Low as per-stream thresholds still bound individual sub-stream expansion.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.
AnalysisAI
Compression bomb detection bypass in Tor before 0.4.9.9 enables remote unauthenticated attackers to deliver resource-exhausting payloads that evade the node's per-stream decompression safeguards. By concatenating multiple gzip or zlib sub-streams - each individually sized just below Tor's detection threshold - an attacker circumvents the aggregate bomb check entirely, potentially degrading availability of Tor nodes or relays. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special non-default configuration is required - any Tor node or relay running a version prior to 0.4.9.9 and accepting network connections is potentially vulnerable when processing compressed data streams. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates remote, unauthenticated, low-complexity exploitation with limited availability impact and no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a specially constructed data stream composed of dozens or hundreds of concatenated gzip or zlib sub-streams, each sized deliberately just below Tor's per-sub-stream compression bomb threshold. This stream is submitted to a reachable Tor node over the network without any authentication; when the node decompresses the stream, the aggregate expanded output far exceeds what the per-stream check would have caught individually, consuming disproportionate memory or CPU. … |
| Remediation | The primary fix is to upgrade to Tor 0.4.9.9 or later, which resolves TROVE-2026-022 with multi-stream-aware compression bomb detection; the ChangeLog confirming the fix is at https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Same weakness CWE-420 – Unprotected Alternate Channel
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today