Executive brief
Tor, the anonymity network software, contained a vulnerability that could cause the application to hang indefinitely when processing truncated compressed data streams. An attacker could exploit this to cause a denial of service by sending specially crafted compressed data, potentially disrupting Tor's ability to relay traffic or communicate.
Technical details
The vulnerability exists in Tor's decompression handling code (buf_add_compress function) when processing truncated zlib or gzip streams with the done flag set to 1. When a truncated stream cannot reach Z_STREAM_END, zlib returns Z_BUF_ERROR to signal no input remains, but the vulnerable code mistakenly interpreted this as indicating a full output buffer and retried the decompression indefinitely, causing an infinite loop. The fix returns TOR_COMPRESS_ERROR upon receiving Z_BUF_ERROR with no remaining input, allowing the caller to abort the operation cleanly. This affects Tor versions before 0.4.9.9 and can be triggered remotely by sending malformed compressed data over the network.
Affected products
- Tor Project Tor before 0.4.9.9
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in version 0.4.9.9