CVE-2026-77639

torproject / Tor PUBLISHED

Description (CNA)

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.

Affected (CNA)

Vendor / product	Versions
torproject / Tor	affected 0.3.1.1-alpha before 0.4.9.9

CWE

CWE-420

References

https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.