CVE-2026-87724

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-09 · updated 2026-09-09
Weakness: CWE-669

Description

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.

Affected products

torprject Tor: from 0.4.9.3-alpha before 0.4.9.12 — fixed in 0.4.9.12

How to fix

Upgrade to a fixed version: torprject Tor 0.4.9.12. Check the vendor advisory for mitigations.

References

https://gitlab.com/torproject/tor/-/commit/10d4b8ffefa7c00aab2b631ed7e7f15e42cd012d
https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.12/ChangeLog

Get alerted when CVE-2026-87724 or the next vulnerability affects your stack