Tor EUVD-2026-63648

No special non-default configuration is required - any Tor node or relay running a version prior to 0.4.9.9 and accepting network connections is potentially vulnerable when processing compressed data streams. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default Tor deployments. Factors that limit exploitation: the availability impact is bounded at A:L (partial degradation, not full crash) because per-stream thresholds still constrain individual sub-stream expansion; network-level throughput limits cap the total decompressed volume an attacker can force in practice; and the attack affects only the processing node's resources rather than propagating across scope boundaries (S:U). Operators running high-bandwidth public relays or bridges that process large volumes of compressed data face the highest exposure.

The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates remote, unauthenticated, low-complexity exploitation with limited availability impact and no confidentiality or integrity consequences. The combination of PR:N and AC:L means the attack is trivially launchable without credentials or special conditions, which elevates practical risk above what a raw score of 5.3 might suggest. However, the A:L ceiling limits the worst-case impact to partial degradation rather than full denial of service. No EPSS data was provided in the input, so exploitation probability cannot be quantified from that signal - it is inferred as low given the absence of POC reports and KEV listing. The 'Authentication Bypass' tag in source metadata appears inconsistent with the actual mechanism (this is a detection evasion, not a traditional auth bypass); analysts should not conflate the two. Overall this is a real but moderate-priority issue: operators running public Tor nodes or relays face the most exposure, while private users have a reduced threat surface.

An attacker crafts a specially constructed data stream composed of dozens or hundreds of concatenated gzip or zlib sub-streams, each sized deliberately just below Tor's per-sub-stream compression bomb threshold. This stream is submitted to a reachable Tor node over the network without any authentication; when the node decompresses the stream, the aggregate expanded output far exceeds what the per-stream check would have caught individually, consuming disproportionate memory or CPU. No POC has been identified at time of analysis, but the low-complexity CVSS vector suggests constructing such a payload requires only basic knowledge of the gzip/zlib container format.