CVE-2026-77640

Received Received - Intake

Infinite Loop in Tor Zlib/Gzip Decompression

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-77640

Affected Vendors & Products

Vendor	Product	Version / Range
tor_project	tor	to 0.4.9.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability is an infinite loop issue in the Tor software before version 0.4.9.9. It occurs when decompressing a truncated zlib or gzip stream with a specific flag set. The decompression process never completes because the stream is incomplete, causing the software to repeatedly retry without making progress, leading to a denial-of-service condition.

Detection Guidance

This vulnerability can be detected by checking the version of Tor running on your system. If you are running a version of Tor before 0.4.9.9, you are vulnerable. Use the command 'tor --version' to check the installed version.

Impact Analysis

This vulnerability can cause a denial-of-service by consuming excessive CPU resources in an infinite loop. If exploited, it may make Tor services unresponsive or crash, disrupting anonymity network operations for users relying on Tor for privacy.

Mitigation Strategies

Immediately update Tor to version 0.4.9.9 or later. This can typically be done using your package manager, such as 'apt-get update && apt-get upgrade tor' on Debian-based systems or 'yum update tor' on RHEL-based systems.

Hi! I’m here to help you understand CVE-2026-77640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70