CVE-2026-77639 in Tor
Summary
by MITRE • 08/21/2026
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified as CVE-2024-39578, tracked in Trove as TROVE-2026-022, represents a significant flaw within the Tor software suite prior to version 0.4.9.9. This issue centers on an insufficient validation mechanism regarding compressed data streams, specifically allowing for what is commonly referred to as a compression bomb bypass. In secure systems, input sanitization and size limiting are critical defenses against resource exhaustion attacks. The specific implementation in earlier versions of Tor failed to adequately account for the cumulative impact of multiple small compressed sub-streams when they were concatenated together by an attacker. This oversight allowed malicious actors to circumvent existing detection thresholds that were designed to limit the expansion ratio or total decompressed size per individual stream, thereby enabling a denial-of-service condition through excessive resource consumption during decompression operations.
From a technical perspective, this flaw aligns with CWE-787: Out-of-bounds Write and more specifically CWE-409: Improper Handling of Highly Compressed Data (Data Amplification). The core issue lies in the application logic that processes gzip or zlib formats. These compression standards support multiple sub-streams within a single file or data block, where each stream can be independently compressed and concatenated. Tor’s decompression routine likely evaluated each sub-stream individually against its configured limits rather than aggregating the potential output size of all streams combined. By crafting payloads consisting of numerous gzip or zlib segments, each carefully sized to remain just below the per-stream detection threshold, an attacker could trigger a massive expansion effect when these streams were processed sequentially. This results in the allocation of excessive memory and CPU cycles as the system attempts to decompress data that appears benign on a per-segment basis but is catastrophic in aggregate volume.
The operational impact of this vulnerability is primarily related to service availability and resource exhaustion. An attacker leveraging this flaw could target Tor relays or clients, causing them to consume disproportionate amounts of memory and processing power during the handling of maliciously crafted network traffic. This can lead to a denial-of-service scenario where legitimate users experience severe latency, connection timeouts, or complete service unavailability due to system instability caused by resource depletion. In distributed networks like Tor, which rely on volunteer-run relays with varying hardware capabilities, such an attack could disproportionately affect nodes with limited resources, potentially degrading the overall anonymity and performance of the network for all connected users. The ability to bypass security controls through stream concatenation highlights a critical gap in input validation strategies that assume single-stream boundaries rather than composite data structures.
Mitigation efforts focus on upgrading the Tor software infrastructure immediately to version 0.4.9.9 or later, where these checks have been corrected to account for cumulative compression effects across concatenated streams. Security administrators should also implement network-level rate limiting and deep packet inspection capabilities that can identify patterns of repeated small compressed payloads indicative of this attack vector. Furthermore, adopting defense-in-depth strategies such as restricting the maximum decompressed size per connection regardless of stream boundaries is advisable. This vulnerability serves as a reminder of the importance of holistic input validation in handling complex data formats like gzip and zlib, ensuring that security controls evaluate the total resource impact rather than isolated components. Organizations should verify their patch management processes to ensure timely deployment of updates addressing CWE-409 related issues within network infrastructure software.