CVE-2026-87724
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which...
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
CVE-2026-87724- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
EUVDEUVD-2026-74539
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
EUVD-2026-74539- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c2x3-p37c-phvc
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which...
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
GHSA-c2x3-p37c-phvc- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
NVD
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
CVE-2026-87724- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
OSV
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
CVE-2026-87724- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-87724
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
DEBIAN-CVE-2026-87724- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-87724
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.
- Record
UBUNTU-CVE-2026-87724- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0392 No score
Updated tor packages fix security vulnerabilities
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state(CVE-2026-87724) Do not purge memory for OOM from within low-level code (TROVE-2026-043). A hostile cache could trick a client into falsely believing that certain relays' microdescriptors or router descriptors were unusable (TROVE-2026-034). Fix a use-after-free error (TROVE-2026-036). Limit the size of consensus diffs, in bytes and in lines, to prevent a class of memory-based denial-of-service attacks (TROVE-2026-042). Negotiate CGO cryptography with every hop that supports it (TROVE-2026-033). Validate DNS names for complience whenever providing or receiving them from evdns, to limit exposure to a class of application and library bugs (TROVE-2026-035).
- Record
MGASA-2026-0392- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11909-1 No score
tor-0.4.9.13-1.1 on GA media
These are all security issues fixed in the tor-0.4.9.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11909-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
All versions, plus listed versions 0.4.7.13-10.4.7.16-10.4.8.10-10.4.8.10-1~bpo11+10.4.8.10-1~bpo12+1 Show 45 moreShow less0.4.8.11-10.4.8.11-1~bpo11+10.4.8.11-1~bpo12+10.4.8.12-10.4.8.12-1.10.4.8.12-1~bpo11+10.4.8.12-1~bpo12+10.4.8.13-10.4.8.13-20.4.8.13-2~bpo12+10.4.8.14-10.4.8.14-1~bpo12+10.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+20.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.8.4-20.4.8.5-10.4.8.6-10.4.8.7-10.4.8.8-10.4.8.9-10.4.8.9-1~bpo11+10.4.8.9-1~bpo12+10.4.9.11-0+deb12u10.4.9.11-10.4.9.11-1~bpo13+10.4.9.12-20.4.9.12-30.4.9.12-40.4.9.13-10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb12u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-0+deb12u10.4.9.8-1 |
None known |
torDebian:13 |
before 0.4.9.12-0+deb13u2, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 21 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.11-0+deb13u10.4.9.11-10.4.9.11-1~bpo13+10.4.9.12-0+deb13u10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb13u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-0+deb13u10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
0.4.9.12-0+deb13u2 |
torDebian:14 |
before 0.4.9.12-2, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 17 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.11-10.4.9.11-1~bpo13+10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
0.4.9.12-2 |
torMageia:10 |
before 0.4.9.12-1.mga10 | 0.4.9.12-1.mga10 |
torMageia:9 |
before 0.4.9.12-1.mga9 | 0.4.9.12-1.mga9 |
torUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.2.3.25-10.2.4.19-10.2.4.20-10.2.4.27-1build0.14.04.10.2.4.27-1ubuntu0.10.2.4.27-1ubuntu0.1+esm10.2.4.27-1ubuntu0.1+esm2 |
None known |
torUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.2.6.10-1ubuntu20.2.7.6-1ubuntu10.2.9.11-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.10.2.9.14-1ubuntu1~16.04.20.2.9.14-1ubuntu1~16.04.30.2.9.14-1ubuntu1~16.04.3+esm1 |
None known |
torUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.3.0.10-10.3.1.8-20.3.1.9-10.3.2.9-10.3.2.9-1build1 Show 4 moreShow less0.3.2.10-10.3.2.10-1ubuntu0.10.3.2.10-1ubuntu0.2~esm10.3.2.10-1ubuntu0.2~esm2 |
None known |
torUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.4.1.5-10.4.1.5-1build10.4.1.6-10.4.2.5-10.4.2.6-10.4.2.7-10.4.2.7-1ubuntu0.1~esm1 |
None known |
torUbuntu:22.04:LTS |
All versions, plus listed versions 0.4.5.9-10.4.6.8-10.4.6.8-1build10.4.6.9-10.4.6.10-10.4.9.11-0ubuntu0.22.04.1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
torUbuntu:24.04:LTS |
All versions, plus listed versions 0.4.8.4-20.4.8.7-10.4.8.9-10.4.8.10-10.4.8.10-1build10.4.8.10-1build20.4.9.11-0ubuntu0.24.04.1 |
None known |
torUbuntu:26.10 |
All versions, plus listed versions 0.4.9.6-10.4.9.8-10.4.9.11-10.4.9.11-1build1 |
None known |
torUbuntu:26.04:LTS |
All versions, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.22-10.4.9.6-10.4.9.11-0ubuntu0.26.04.1 |
None known |
toropenSUSE:Tumbleweed |
before 0.4.9.13-1.1 | 0.4.9.13-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-87724 is a medium vulnerability (CVSS 6.5) in Torprject Tor, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in tor 0.4.9.12-0+deb13u2.
References
gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.12/ChangeLog
gitlab.com/torproject/tor/-/commit/10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d
nvd.nist.gov/vuln/detail/CVE-2026-87724
github.com/advisories/GHSA-c2x3-p37c-phvc
security-tracker.debian.org/tracker/CVE-2026-87724
Show 8 moreShow less
advisories.mageia.org/MGASA-2026-0392.html
bugs.mageia.org/show_bug.cgi?id=36284
openwall.com/lists/oss-security/2026/09/08/20
ubuntu.com/security/CVE-2026-87724
cve.org/CVERecord?id=CVE-2026-87724
suse.com/security/cve/CVE-2026-87724
Left out here: 4 versions. The JSON record has them.