CVE-2026-87724
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupt…
Published: 2026-09-09 · CVSS: 6.5 · CVSS 3.1
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7