CVE-2026-87724

Deferred Deferred - Pending Action

Denial of Service in Tor due to CC_RESPONSE Extension Handling

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: MITRE

Description

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87724

EUVD

EUVD-2026-74539

Affected Vendors & Products

Vendor	Product	Version / Range
torproject	tor	to 0.4.9.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-669	The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Tor network software improperly handling the CC_RESPONSE extension. Normally, CC_RESPONSE should only be accepted if a CC_REQUEST was sent first. However, Tor before version 0.4.9.12 would interpret CC_RESPONSE even without a prior CC_REQUEST, causing corrupted congestion-control state and leading to crashes.

Detection Guidance

To detect this vulnerability, check the Tor version running on your system. If it is below 0.4.9.12, the system is vulnerable. Use the command 'tor --version' to verify the installed version.

Impact Analysis

This vulnerability could allow a remote attacker to crash Tor instances by exploiting the improper handling of the congestion control extension. This may disrupt anonymity services for users relying on Tor for privacy or bypassing censorship.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a software crash in Tor network instances rather than data protection or privacy violations. Compliance risks would arise only if the crash led to service disruptions affecting regulated data handling.

Mitigation Strategies

Upgrade Tor to version 0.4.9.12 or later to address the improper handling of the CC_RESPONSE extension.
Monitor Tor instances for crashes or invalid state errors related to congestion control extensions.

Hi! I’m here to help you understand CVE-2026-87724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70