Executive brief
Tor, the privacy-focused anonymous networking software, contains a flaw in how it detects and blocks "compression bomb" attacks. An attacker could exploit this by sending specially crafted compressed data that bypasses safety checks, potentially allowing resource exhaustion or denial of service against Tor relays and clients.
Technical details
The vulnerability is a compression bomb bypass in Tor's gzip/zlib stream decompression logic. An attacker can concatenate multiple gzip or zlib sub-streams, each individually below the per-stream compression detection threshold, allowing them to collectively exceed the intended limit and evade the compression bomb protection. The attack requires network access to a Tor relay or client that processes the malicious compressed data. A successful exploit can cause excessive CPU and memory consumption on the target Tor node, leading to denial of service. The issue was fixed in Tor version 0.4.9.9.
Affected products
- Tor Project Tor before 0.4.9.9
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in Tor 0.4.9.9