Torprject vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Torprject products: 1 record(s), with severity, exploitation and fixes.

Tor 1

Exploited only (KEV) →

CVE-2026-87724 Medium · 6.5 CWE-669 Sep 8, 2026

Incorrect Resource Transfer Between Spheres in Torprject Tor

Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.