Description

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-20T21:17:11.373Z",
  "pubdate": "2026-08-20T21:17:11.373Z",
  "executiveSummary": "A denial of service vulnerability exists in Tor before version 0.4.9.9, specifically residing within its compression handling logic. The vulnerability is triggered when the application attempts to decompress a maliciously crafted or truncated zlib or gzip stream where the completion flag is set to done=1. Due to improper error handling of status codes returned by the underlying zlib library, the affected function enters an unrecoverable infinite loop, exhausting CPU resources and disrupting service availability.\nThe flaw impacts the Tor network daemon across affected versions. Successful exploitation results in a complete denial of service for the targeted Tor instance, as the process hangs indefinitely attempting to retry the failed decompression operation. The attacker capabilities involve supplying or triggering the processing of a truncated compressed stream, which can lead to resource exhaustion without requiring authentication or elevated privileges, depending on the network exposure of the vulnerable vector.",
  "technicalDetails": "The root cause of the vulnerability lies within the buf_add_compress() function in Tor before version 0.4.9.9. When decompressing zlib or gzip streams with the done=1 parameter, a truncated stream fails to reach the expected Z_STREAM_END state. Under these conditions, the zlib library returns a Z_BUF_ERROR status code indicating that no further input remains to be processed and the output buffer is not fully consumed.\nThe vulnerable component, buf_add_compress(), incorrectly interprets the Z_BUF_ERROR return value under this specific execution context as an indication of a full output buffer rather than an abnormal stream termination. Consequently, instead of handling the decompression failure or propagating an error state, the function enters an infinite retry loop attempting to flush or continue processing the non-existent remaining input.\nThe attack flow proceeds as follows: An unauthenticated entity provides or transmits a truncated zlib or gzip compressed stream to the Tor daemon. The vulnerable routine buf_add_compress() processes the input stream with the completion parameter set to done=1. The underlying compression library encounters the truncation and returns Z_BUF_ERROR. The Tor codebase misinterprets this status code and initiates a continuous retry loop. Because the input stream is truncated and incomplete, the condition is never resolved, causing the thread or process to hang indefinitely in an infinite loop, consuming 100 percent of CPU cycles and rendering the service unresponsive.\nAffected versions include all Tor releases prior to 0.4.9.9. The vulnerability requires no authentication or special privileges to trigger if an attacker can cause the target Tor instance to ingest and decompress the malformed stream over an exposed network protocol or interface utilizing the vulnerable buffering mechanism."
}