Description

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-20T21:17:11.233Z",
  "pubdate": "2026-08-20T21:17:11.233Z",
  "executiveSummary": "Tor before 0.4.9.9 is vulnerable to a compression bomb bypass flaw, designated as TROVE-2026-022. This vulnerability allows an attacker to completely circumvent built-in compression bomb detection mechanisms by manipulating stream structures. The primary impact is the potential facilitation of denial-of-service or resource exhaustion states within affected Tor systems through unmitigated decompression demands. The affected product is Tor across versions prior to 0.4.9.9. The risk implications include the degradation of daemon stability and anomalous memory or CPU consumption when processing maliciously crafted streams. Attacker capabilities involve the remote transmission of concatenated compression sub-streams designed to evade safety thresholds. Exploitation requirements mandate the construction of specific payload architectures where individual sub-streams remain strictly below the per-stream detection threshold.",
  "technicalDetails": "The root cause of TROVE-2026-022 lies in the insufficient aggregation logic of the compression bomb detection subsystem when evaluating multi-part gzip or zlib data streams. Tor implements safety thresholds intended to flag and terminate decompression routines if a single stream exceeds predefined size or expansion ratios, thereby defending against resource exhaustion attacks. However, the parser evaluates these limits on a strictly per-stream basis without adequately enforcing cumulative tracking across consecutive boundaries. The exploitation method relies on payload fragmentation and concatenation. An attacker crafts a malicious payload by chaining together multiple gzip or zlib sub-streams sequentially. Each individual sub-stream is engineered to remain just under the per-stream detection threshold, allowing it to pass individual safety checks successfully. The attack flow proceeds as the Tor daemon ingests the concatenated payload and sequentially processes each sub-stream through the vulnerable decompression routines. Because each sub-stream evades the individual detection threshold, the cumulative expansion of the fully concatenated payload bypasses the compression bomb check entirely. The vulnerable component is the stream parsing and decompression engine responsible for handling compressed data flows within Tor versions prior to 0.4.9.9. The vulnerability is accessible over the network where Tor processes compressed streams, typically requiring no authentication or elevated privileges to transmit the malformed payload. The post-exploitation impact includes excessive CPU consumption, memory exhaustion, and potential application crashes, culminating in a denial-of-service condition for the affected Tor instance."
}