CVE-2026-87724 Overview
CVE-2026-87724 is a denial-of-service vulnerability in the Tor anonymity network daemon affecting versions prior to 0.4.9.12. The flaw, tracked internally as TROVE-2026-032, resides in the congestion-control extension handling logic. Tor interprets a CC_RESPONSE extension even when the corresponding CC_REQUEST was never sent. This desynchronization corrupts the congestion-control state and triggers a crash. Remote attackers can exploit this over the network without authentication or user interaction. The issue is categorized under [CWE-669: Incorrect Resource Transfer Between Spheres].
Critical Impact
Remote unauthenticated attackers can crash Tor relays and clients by sending unsolicited CC_RESPONSE extensions, degrading availability of the Tor network.
Affected Products
- Tor daemon versions before 0.4.9.12
- Tor relays running affected releases
- Tor clients and bridges built on the vulnerable code base
Discovery Timeline
- 2026-09-09 - CVE-2026-87724 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87724
Vulnerability Analysis
The vulnerability lives in Tor's congestion-control negotiation logic. Tor implements protocol extensions that peers exchange during circuit setup. The CC_REQUEST extension signals a peer's intent to negotiate congestion-control parameters. The CC_RESPONSE extension is meant to answer that request.
The defective code path accepts a CC_RESPONSE extension regardless of whether the local instance previously sent a CC_REQUEST. Processing an unsolicited response mutates congestion-control state that was never initialized for negotiation. The resulting inconsistency triggers an assertion failure or invalid state transition, crashing the process.
Attack complexity is elevated because the attacker must reach the vulnerable code path through the Tor protocol handshake. However, no privileges or user interaction are required, and the impact is process termination. The EPSS score is 0.26% at the 17th percentile at time of publication.
Root Cause
The root cause is missing state validation before consuming a protocol extension. The handler for CC_RESPONSE does not check whether a matching CC_REQUEST was issued on the same circuit. This violates the request-response contract and allows attacker-controlled input to reach state-mutation code in an invalid context, mapping to [CWE-669].
Attack Vector
An attacker delivers a crafted CC_RESPONSE extension over the Tor network to a target relay or client. The vulnerable peer processes the extension without verifying prior request state. Congestion-control state becomes corrupted and the daemon crashes. Repeated exploitation can disrupt onion routing paths and reduce the availability of exit and middle relays.
The vulnerability was addressed in Tor 0.4.9.12. See the GitLab Commit for Tor Project and the Tor Project ChangeLog 0.4.9.12 for the code-level fix.
Detection Methods for CVE-2026-87724
Indicators of Compromise
- Unexpected termination of the tor process with assertion failures referencing congestion-control state.
- Log entries indicating processing of CC_RESPONSE without a preceding CC_REQUEST on the same circuit.
- Repeated relay restarts or circuit failures correlated with inbound connections from a small set of peers.
Detection Strategies
- Monitor Tor daemon logs for crash signatures, tor_assertion_failed_ messages, and abnormal exit codes.
- Correlate process crashes with network telemetry to identify peers sending malformed extensions.
- Track relay uptime metrics reported to directory authorities for anomalous churn.
Monitoring Recommendations
- Ingest Tor logs and host telemetry into a centralized analytics platform for correlation across relays.
- Alert on repeated tor service restarts within short time windows on the same host.
- Baseline circuit establishment rates and flag deviations that align with denial-of-service attempts.
How to Mitigate CVE-2026-87724
Immediate Actions Required
- Upgrade all Tor relays, bridges, and clients to version 0.4.9.12 or later without delay.
- Inventory hosts running the Tor daemon and verify the running binary version rather than package metadata alone.
- Restart the tor service after upgrade to ensure the patched code path is active.
Patch Information
The fix is included in Tor 0.4.9.12. The upstream commit 10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d adds validation that rejects CC_RESPONSE extensions when no matching CC_REQUEST was issued. Refer to the Tor Project ChangeLog 0.4.9.12 for the full list of security fixes shipped in this release.
Workarounds
- No configuration-only workaround eliminates the flaw; upgrading is the supported remediation.
- Operators of critical relays should enable automatic process supervision to restart the daemon after crashes until the patch is applied.
- Restrict management interfaces and ensure host-level monitoring is in place to detect exploitation attempts during the upgrade window.
# Verify installed Tor version after upgrade
tor --version
# Example: Debian/Ubuntu upgrade path
sudo apt update
sudo apt install --only-upgrade tor
sudo systemctl restart tor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
