CVE-2026-87724

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87724
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87724.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87724
Downstream
Related
Published
2026-09-09T01:29:46Z
Modified
2026-10-21T11:19:19Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
[none]
Details

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-669"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87724.json"
}
References

Affected packages

Git / gitlab.com/torproject/tor

Affected ranges

Type
GIT
Repo
https://gitlab.com/torproject/tor
Events
Introduced
1ee22f8f9a98719d32e5e4056013b68054b6448d
Fixed
78923280eed3eff6a77910bba59ecc1fa2244e02
Fixed
10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.4.9.3-alpha"
                },
                {
                    "fixed":  "0.4.9.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

tor-0.*
tor-0.4.9.10
tor-0.4.9.11
tor-0.4.9.3-alpha
tor-0.4.9.4-rc
tor-0.4.9.5
tor-0.4.9.6
tor-0.4.9.7
tor-0.4.9.8
tor-0.4.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87724.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "62332899444020888018851657373322938222",
                "64493866503926871710646425132980693646",
                "193245936922426399408253268526564430264",
                "282354163477781778305220697599622255623"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87724-33bc7302",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/torproject/tor@10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d",
        "target":  {
            "file":  "src/core/or/circuitbuild.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "305911226959131534033670284527196515329",
            "length":  483
        },
        "id":  "CVE-2026-87724-86573e0c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/torproject/tor@10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d",
        "target":  {
            "file":  "src/core/or/congestion_control_common.c",
            "function":  "congestion_control_parse_ext_response"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "124838486103289384273301848118487794488",
            "length":  884
        },
        "id":  "CVE-2026-87724-95ced742",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/torproject/tor@10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d",
        "target":  {
            "file":  "src/core/or/circuitbuild.c",
            "function":  "client_circ_negotiation_message"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "37751175610215429673734468230578475594",
                "95250039497090763151346936975982146869",
                "186404589466429306104255548767454914460",
                "184836493114267718151989606002120475680"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87724-c76115df",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/torproject/tor@10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d",
        "target":  {
            "file":  "src/core/crypto/onion_crypto.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "43186375213271415954018098311275969962",
                "150982961868216504644621065820941064047",
                "127417055593047164982179490589691985036",
                "281875261801572164415637372375626650372",
                "223802835313013089437443625030441535856"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-87724-d113586b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.com/torproject/tor@10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d",
        "target":  {
            "file":  "src/core/or/congestion_control_common.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T11:19:19Z"