CVE-2026-87724 in Tor
Summary
by MITRE • 09/09/2026
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-XXXX, associated with the identifier TROVE-2026-032, represents a critical logic error within the Tor software suite prior to version 0.4.9.12. This flaw specifically affects the implementation of the congestion control extension mechanism in the Tor protocol stack. The core technical deficiency lies in the application's failure to validate the sequence and presence of preceding handshake messages before processing incoming data extensions. Specifically, the software incorrectly interprets a CC_RESPONSE packet even when no corresponding CC_REQUEST was previously transmitted by that connection endpoint. This lack of state validation allows an attacker who can inject or manipulate network traffic at the protocol level to trigger unintended code paths within the congestion control subsystem.
From a technical perspective, this issue stems from improper input validation and state machine management. In standard TCP/IP implementations, congestion control parameters are negotiated through explicit request-response exchanges to ensure both endpoints agree on flow control settings. By accepting a CC_RESPONSE without verifying that a CC_REQUEST was sent first, Tor creates an inconsistent internal state. The application proceeds to apply the parameters contained in this unsolicited response to its existing connection context. Because these parameters were not mutually agreed upon and may contain malformed or unexpected values, they corrupt the congestion-control state machine. This corruption leads to memory management errors or logical deadlocks within the network processing threads, ultimately resulting in a process crash.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. A remote attacker can exploit this flaw by sending crafted CC_RESPONSE packets to Tor relays or clients running vulnerable versions. Successful exploitation results in a denial of service condition where the affected Tor instance crashes and becomes unavailable for routing traffic. For users relying on Tor for anonymity, such disruptions degrade network performance and reliability. While the crash itself does not directly expose sensitive data, it can be used as part of a broader attack strategy to disrupt censorship circumvention efforts or force nodes offline, thereby reducing the overall capacity and resilience of the Tor network.
This vulnerability aligns with CWE-20 Improper Input Validation, as the software fails to adequately verify that incoming messages conform to expected protocol sequences. It also relates to CWE-841 Improper Enforcement of Behavioral Workflow because the application does not enforce the correct order of operations for congestion control negotiation. In terms of offensive security frameworks, this exploit technique maps to MITRE ATT&CK Tactic TA0002 Execution and specifically techniques involving resource exhaustion or denial of service via protocol manipulation. The lack of state verification is a common pattern in network daemons that prioritize performance over strict protocol adherence, leading to such stability issues.
Mitigation for this vulnerability requires immediate upgrading to Tor version 0.4.9.12 or later, where the logic error has been corrected to enforce proper validation of CC_REQUEST presence before processing any associated responses. Network administrators operating public relays should ensure their infrastructure is patched promptly to prevent potential service disruptions caused by malicious actors targeting these nodes. Additionally, organizations deploying Tor for internal communications should verify that all client and relay instances are updated across the deployment environment. Future development efforts in similar network protocols should prioritize rigorous state machine validation and fuzz testing of extension handling logic to prevent analogous issues where out-of-order or unsolicited messages can corrupt application state.