CVE-2026-77639
Medium
Description
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.
SeverityMedium
CVSS5.3
Exploit probability—
ProductTor
PublishedAug 20, 2026
First seenAug 20, 2026
Weakness typeCWE-420CWE-420
How to fix
Update
- torproject tor0.4.9.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| torproject tor | v < 0.4.9.9 | 0.4.9.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.