CVE-2026-87724 PUBLISHED

Assigner: mitre
Reserved: 09.09.2026 Published: 09.09.2026 Updated: 09.09.2026

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	torprject
Product	Tor
Versions	Default: unaffected affected from 0.4.9.3-alpha to 0.4.9.12 (excl.)

References

https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.12/ChangeLog
https://gitlab.com/torproject/tor/-/commit/10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d

Problem Types

CWE-669 Incorrect Resource Transfer Between Spheres CWE