CVE-2026-87724

Executive Summary

CVE-2026-87724 is a remotely exploitable denial-of-service (DoS) vulnerability in the Tor anonymity network's codebase, affecting all versions prior to 0.4.9.12. The flaw resides in the handling of the CC_RESPONSE congestion-control extension: Tor interprets this message even when the corresponding CC_REQUEST was never transmitted by the peer, leading to corrupted congestion-control state and subsequent process crash. Successful exploitation results in an availability impact (CVSS 3.1 base score 6.5, High), potentially disrupting relay and client operations across the network. There is no evidence of active exploitation, public proof-of-concept code, or CISA KEV inclusion as of this report; the vulnerability remains unpatched in the sense that no patch source has been officially confirmed by tracking partners.

Technical Analysis

The vulnerability is categorized under CWE-669 (Improper Resource Shutdown or Release), though the described mechanism points more directly to a logic error in protocol state management — specifically, incorrect handling of an out-of-sequence message within Tor's congestion-control subsystem, which was introduced as part of the Prop#324 congestion control work.

Vulnerability Mechanism. Tor's congestion-control implementation uses a pair of extension messages: CC_REQUEST (sent by a client to signal it supports congestion control) and CC_RESPONSE (sent by a relay/edge node to acknowledge or negotiate parameters). The protocol specification mandates that a CC_RESPONSE is valid only after a CC_REQUEST has been exchanged. The vulnerable code path fails to validate this state transition. When a malicious or buggy peer sends an unsolicited CC_RESPONSE message, Tor processes it as legitimate, mutating internal congestion-window counters, acknowledgment arrays, or pacing state — all of which are used to govern outbound cell traffic.

Corrupted State Leading to Crash. The crash is not caused by a classic memory-corruption bug (e.g., buffer overflow) but by a logic flaw that leaves the congestion-control state machine in an inconsistent state. Depending on the specific data embedded in the CC_RESPONSE (e.g., sequence numbers, window sizes), Tor may attempt to access out-of-bounds array indices, perform division by zero in pacing calculations, or fall into an infinite loop while attempting to recover from the erroneous state. The NVD description confirms the result is a crash due to "corrupted congestion-control state" — no privilege escalation or arbitrary code execution is implied.

Attack Surface. The attack surface is the Tor protocol's link-layer (TLS-encrypted channels between Tor nodes). Any system capable of establishing a Tor circuit — i.e., any client, relay, or onion service — can theoretically deliver the malicious CC_RESPONSE. The attacker does not need prior authentication beyond standard Tor handshake. Note the CVSS access complexity is High (AC:H), suggesting that successful exploitation may depend on precise timing, specific circuit conditions, or the target's configuration (e.g., whether congestion control is enabled on the circuit).

Affected Component. The channel.c/relay.c or dedicated congestion-control file (exact file names unavailable from provided data) processes relay cells containing the CC_RESPONSE extension. The bug is referenced as TROVE-2026-032, which is the Tor Project's internal tracking ID, confirming the issue is known to upstream developers.

Exploitation Scenarios

Attack Chain Overview. Since no public PoC exists and the NVD description is sparse on implementation details, the following chain is inferred from the vulnerability class (protocol state confusion) and standard Tor operational knowledge.

1. Reconnaissance & Target Identification. The attacker selects a Tor relay or exit node as a target. Public Tor relay lists (e.g., metrics.torproject.org) provide IP addresses, OR ports (typically 9001 or 443), and fingerprints. Alternatively, the attacker may target a specific onion service's intro point. The requirement is only that the target is running Tor version 0.4.9.11 or earlier.

2. Triggering the Flaw. The attacker establishes a standard Tor circuit that includes the target as one of the hops. During circuit construction or in a subsequent data-transfer phase, the attacker crafts a RELAY_EARLY or RELAY cell carrying a CC_RESPONSE extension. The cell is designed so the extension header contains a valid type identifier for CC_RESPONSE but the payload is crafted to induce state corruption — e.g., by including sequence numbers that exceed Tom's receive window, or by omitting required fields that the target expects. Critically, the attacker does NOT send the prerequisite CC_REQUEST. The target's relay code processes the unsolicited CC_RESPONSE without checking the established state.

3. Execution Mechanism. The corrupted congestion-control state causes the target to miscalculate available send window, leading to arithmetic errors in internal counters. In the simplest scenario, this triggers an assert() failure or an explicit tor_assert() check in the congestion-control code, causing an abort. In more complex cases, the pacing algorithm may enter a state where it attempts to send more cells than the circuit window allows, leading to an internal consistency check failure and the Tor process shutting down.

4. Post-Exploitation Impact. Each crash requires the attacker to re-establish a circuit and send another malformed cell. While the Tor daemon may restart automatically (if configured with a supervisor like systemd), each crash causes temporary local unavailability of that relay, degrading overall network capacity. A distributed attack targeting multiple relays simultaneously could cause cascading circuit failures for clients, amplifying the DoS beyond a single node. The confidentiality impact (C) is None, integrity impact (I) is Low (potential corrupted counters visible in logs), availability impact (A) is High — consistent with the CVSS vector.

Note: No public PoC exists; this chain is inferred from the vulnerability class. Specific cell payload structures and trigger conditions are not confirmed.

Impact Assessment

Business Impact. Tor is a critical privacy infrastructure. A DoS on Tor relays affects:

• Anonymity seekers (journalists, activists) who rely on stable circuits.
• Tor onion services (e.g., secure drop sites) whose availability depends on underlying relays.
• **Organizations using Tor for internal threat-intel collections or as a research tool.

An attacker achieving repeated crashes can force clients to rebuild circuits, increasing latency and potentially exposing metadata through circuit rotation. Sustained attacks against high-bandwidth relays (those carrying exit traffic) can degrade the network's overall throughput, making Tor unusable for bulk downloads and impacting legitimate users.

CVSS Scoring (Base 6.5, High):

• Attack Vector: Network — Exploitable remotely.
• Attack Complexity: High — Requires precise protocol-level crafting and specific circuit arrangements; not a simple one-shot script.
• Privileges Required: None — No authentication or pre-placed state needed.
• User Interaction: None.
• Scope: Unchanged — Impact confined to the tor process.
• Confidentiality: None.
• Integrity: Low — Minor state corruption visible as log inconsistencies.
• Availability: High — Process crash is the direct outcome.

Blast Radius. While the vulnerability is in the Tor daemon, the broader ecosystem impact includes latency spikes and reduced anonymity set for all Tor users when relays churn. The Tor network is only as reliable as its least stable relays; each crash contributes to overall performance degradation.

Detection Guidance

Detection is challenging because the malicious traffic is legitimate-looking Tor protocol data (encrypted inside TLS). Network-level detections focus on protocol anomalies visible prior to encryption (e.g., handshake patterns) or are limited to measuring crash rates. Host-level detection focuses on Tor process behavior and log messages.

Sigma Rule

title: Tor Process Crash - Corrupted Congestion Control State (CVE-2026-87724)
id: c5f0e1a2-8a3b-4c4d-9e5f-6a7b8c9d0e1f
status: experimental
description: Detects Tor daemon crashes or error messages consistent with corrupted congestion-control state, which may indicate exploitation of CVE-2026-87724.
logsource:
  category: process_creation
  product: linux
detection:
  selection_tor_crash:
    Image|endswith: 
      - '/tor'
      - 'tor.exe'
    ExitCode:
      - '1'
      - '134'  # SIGABRT
  selection_tor_error:
    Image|endswith: 
      - '/tor'
      - 'tor.exe'
    CommandLine|contains:
      - 'congestion'
      - 'cc_response'
      - 'TROVE-2026-032'
  condition: selection_tor_crash or selection_tor_error
level: high
falsepositives:
  - Legitimate crashes due to OOM or hardware issues
  - Debugging sessions with forced aborts
tags:
  - attack.t1499
  - cve.2026-87724

YARA Rule

rule TOR_CVE_2026_87724_CONGESTION_CRASH {
    meta:
        author = "Valters IT Security Research"
        description = "Detects Tor log files or memory artifacts containing crash identifiers related to CVE-2026-87724 congestion-control corruption"
        date = "2026-02-15"
        cve = "CVE-2026-87724"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87724"
    strings:
        $s1 = "CC_RESPONSE received without request" ascii wide nocase
        $s2 = "cc-response without cc-request" ascii wide nocase
        $s3 = "corrupted congestion control state" ascii wide nocase
        $s4 = "TROVE-2026-032" ascii wide nocase
        $s5 = "congestion_control_state" ascii wide nocase
        $s6 = "cc_window" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) or filesize < 50MB
        and any of ($s1, $s2, $s3, $s4)
        or (2 of ($s1, $s2, $s4, $s6))
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $TOR_SERVERS 9001 (msg:"TOR CVE-2026-87724 - Potential unsolicited CC_RESPONSE attempt"; flow:to_server,established; content:"|00 00 00 00 00 00|"; depth:6; content:"CC_RESPONSE"; nocase; within:50; reference:cve,2026-87724; classtype:attempted-dos; sid:202687724; rev:1;)

Note: Tor's Link Protocol is TLS-encrypted, so this rule will only be effective if the peer is using an unencrypted clearnet protocol variant (e.g., during testing). For real-world encrypted traffic, rely on host-based detection.

Elastic Detection

sequence by process.entity_id with maxspan=10m
  [process where event.type == "start" and process.name == "tor"
   and process.args : "*congestion*" or process.args : "*cc-response*"]
  [process where event.type == "end" and process.exit_code in (1, 134)]

Splunk SPL Query

index=main sourcetype=tor_log
| where match(_raw, "(?i)(CC_RESPONSE)\s*(received|without|no)\s*(request|CC_REQUEST|TROVE)")
   OR match(_raw, "corrupted congestion-control state")
   OR match(_raw, "TROVE-2026-032")
| stats count by host, source, _time
| sort - _time

Wazuh OSSEC Rule

<group name="tor,">
  <rule id="100877" level="12">
    <decoded>
      <program_name>tor</program_name>
    </decoded>
    <match>CC_RESPONSE|cc-response|corrupted congestion-control|TROVE-2026-032</match>
    <description>Tor process crashed or encountered an error consistent with CVE-2026-87724, an unsolicited congestion-control response leading to state corruption.</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch evidence from any tracked source; however, the NVD description explicitly states the fixed version is Tor 0.4.9.12. Trackers have not independently confirmed this release.

Immediate Mitigations (until an official patch is deployed)

1. Restrict circuit ingress — configure Tor relays to reject RELAY_EARLY cells from non-approved OR connections where feasible (not a standard option, but can be implemented via torrc firewall rules at the OS level).
2. Run Tor under a supervisor (systemd/daemontools) with auto-restart to reduce manual intervention after crashes. Configure Restart=always in the unit file.
3. Enable core dumps and remote logging (e.g., via syslog forwarding) to capture crash artifacts for forensic analysis.
4. Monitor for unexpected Tor process restarts using the EQL/SPL rules above.

Patch/Upgrade Steps

1. As soon as Tor 0.4.9.12 or later is officially released (per vendor advisory), upgrade all relay and client instances.
2. On Debian/Ubuntu: sudo apt update && sudo apt install tor (after adding the Tor Project's apt repository to get 0.4.9.x builds).
3. On RedHat/CentOS: use the Tor Project's RPM repository.
4. After upgrade, verify version: tor --version (should output ≥ 0.4.9.12).
5. For containerized deployments, rebuild images with the updated tor binary.

Long-Term Hardening

1. Network segmentation: restrict ORPort (typically 9001) to only accept connections from known relay IPs (if running a non-public relay).
2. Rate limiting: deploy reverse proxies or iptables hashlimit rules to limit new TLS handshakes per source IP, reducing crash-and-reconnect churn.
3. Protocol validation: subscribe to Tor's security advisories (oss-security list or tor-project mailing list) for early disclosure of such fl a ws.
4. Routine threat hunting: review crash logs for patterns matching "congestion" strings; anomalous spikes indicate active exploitation attempts.
5. Backup configuration: ensure torrc is versioned to allow rapid rollback if a regression is found in the patch.

References

1. NVD Entry: (placeholder) National Vulnerability Database entry for CVE-2026-87724 — standard structure for updates.
2. Tor Project Security Advisory: TROVE-2026-032, referencing the fix in the 0.4.9.12 release notes — available on Tor's official blog.
3. CWE-669: MITRE's definition of "Improper Resource Shutdown or Release" — technical background on the vulnerability class.
4. CVSS Calculator: First.org CVSS v3.1 vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H corresponding to a base score of 6.5.
5. MITRE ATT&CK: T1499 – Endpoint Denial of Service, referenced for detection rule classification.

Note: No entries in CISA KEV, no public exploit code, and no known threat-actor campaigns as of the report date (based on provided data). All URLs above are placeholders — the authoritative references would be the actual NVD page and Tor's advisory, which should be cited with their concrete URLs once made publicly available post-disclosure.