EUVD-2026-63650
GHSA-5g6h-2vr8-m7f4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network vector confirmed by Tor's relay architecture; AC:H reflects precision required to craft a valid truncated zlib stream; A:L because impact is per-connection CPU exhaustion, not daemon-wide crash.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.
AnalysisAI
Infinite loop denial-of-service in Tor before 0.4.9.9 allows a remote, unauthenticated attacker to cause sustained CPU exhaustion on a vulnerable node by delivering a crafted truncated zlib/gzip compressed stream. The root cause is in buf_add_compress(), which misinterpreted zlib's Z_BUF_ERROR return (no remaining input) as a full output buffer requiring retry, looping forever without progress. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to deliver a crafted, deliberately truncated zlib/gzip compressed stream to a Tor node running a version prior to 0.4.9.9. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.7 score accurately reflects a low-to-moderate risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker controlling a malicious Tor relay sends a zlib/gzip-compressed stream to a victim Tor node running a version prior to 0.4.9.9, deliberately truncating the stream so it never emits Z_STREAM_END. The victim node's buf_add_compress() function enters an infinite loop, consuming CPU on that connection handler without bound. … |
| Remediation | Upgrade to Tor version 0.4.9.9 or later, which resolves TROVE-2026-021 by modifying buf_add_compress() to return TOR_COMPRESS_ERROR when zlib signals Z_BUF_ERROR with no remaining input, allowing callers to abort cleanly rather than retry indefinitely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discove
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-s
A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. Rated high severity (CVSS 7.5), this vulnerability
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not th
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before att
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden servic
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the r
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the c
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 bef
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today