Tor EUVD-2026-63650

Exploitation requires the ability to deliver a crafted, deliberately truncated zlib/gzip compressed stream to a Tor node running a version prior to 0.4.9.9. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required. The key limiting factor is attack complexity (AC:H): the attacker must construct a stream that is syntactically valid enough for Tor to begin decompressing but truncated in a way that exhausts zlib's input without completing the stream, triggering Z_BUF_ERROR with done=1. The most natural attack position is a malicious Tor relay node that can inject or serve compressed data to a victim relay. No non-default configuration is required - any Tor installation that processes zlib/gzip-compressed streams is affected.

The CVSS 3.7 score accurately reflects a low-to-moderate risk profile. The network attack vector (AV:N) confirms remote exploitability, but high attack complexity (AC:H) imposes a meaningful constraint: the attacker must precisely craft a truncated zlib/gzip payload that exhausts zlib's input without completing the stream, which requires non-trivial knowledge of the compression format. The availability impact is rated Low (A:L), consistent with per-connection or per-thread CPU exhaustion rather than a full daemon crash. No EPSS data was provided, leaving exploitation probability unquantified from that signal; the absence of a CISA KEV listing means no confirmed active exploitation is on record. There is no public exploit code identified at time of analysis. The practical threat is most relevant to operators running public Tor relays or bridges that process compressed traffic from untrusted peers - a targeted attacker controlling a malicious relay could abuse this to degrade a victim node's performance, but the high complexity and limited availability impact mean most deployments can treat this as a routine patch-cycle priority rather than emergency response.

An attacker controlling a malicious Tor relay sends a zlib/gzip-compressed stream to a victim Tor node running a version prior to 0.4.9.9, deliberately truncating the stream so it never emits Z_STREAM_END. The victim node's buf_add_compress() function enters an infinite loop, consuming CPU on that connection handler without bound. No public exploit code has been identified, and high attack complexity (AC:H) requires precise crafting of the malformed payload.