PT-2026-88760
CVE-2026-87724
·
Published
2026-09-09
·
Updated
2026-09-28
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions
Tor versions prior to 0.4.9.12
Description
The software incorrectly interprets the CC RESPONSE extension even when a CC REQUEST was not previously sent. This behavior allows remote attackers to corrupt the congestion-control state, leading to a denial of service resulting in a crash.
Recommendations
Update to version 0.4.9.12 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾