CVE-2026-77639
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely.
Risk Assessment
An attacker could exploit this to overload the system, leading to denial of service and resource exhaustion.
Recommendation
Upgrade Tor to version 0.4.9.9 or later to fix this vulnerability.
Other vulnerabilities in Tor
See all- CVE-2016-1254High
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
- CVE-2017-8823High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free vulnerability in onion service v2 during intro-point expiration due to mismanagement of the expiring list in certain error cases.
- CVE-2017-8821High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password, triggering an attempt by the OpenSSL library to ask the user for the password.
- CVE-2017-8820High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service via a NULL pointer dereference, leading to application crash.
- CVE-2017-8819High
In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services. An attacker can send many INTRODUCE2 cells to trigger this issue.
- CVE-2017-0377High
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay, not the exit relay's family. This may allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
- CVE-2017-0375High
The hidden-service feature in Tor before version 0.3.0.8 allows a denial of service (assertion failure and daemon exit) via a malformed BEGIN cell.
- CVE-2016-8860High
Tor versions before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had functions that expected buf_t data to be NUL terminated. The implementation in or/buffers.c did not ensure this termination, allowing remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.
- CVE-2026-77642High
Tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities.
- CVE-2026-77641Medium
Tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. Ignoring the return value of relay_send_command_from_edge() leads to a crash.
Original NVD description (English source)
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.