CVE-2026-77640CWE-1284

CVE-2026-77640

Low · published August 21, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2026-08-21T01:17Z
Affected products (1)
ProductVersionsFixed in
torproject/tor< 0.4.9.90.4.9.9
References (1)
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog · [email protected]
EPSS history
Timeline
  • 20 AUG 21:02Z
    tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1
    cvelistv5