CVE-2026-87724CWE-669

CVE-2026-87724

Medium · published September 9, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.0th percentile
Weakness
CWE-669 · Incorrect Resource Transfer Between Spheres
Published
2026-09-09T06:16Z
References (2)
https://gitlab.com/torproject/tor/-/commit/10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d · [email protected]https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.12/ChangeLog · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 01:29Z
    Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash)…
    cvelistv5