01 Record

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no

LowPUBLISHEDCNA: mitre

Base score3.7 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

View raw JSON CVE Program record

02 Description

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no

03 Metadata

Published

2026-08-20 21:02Z1 DAY AGO

Last updated

2026-08-20 21:02Z1 DAY AGO

Reserved

2026-08-20

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Low (CVSS 3.7)

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-1284Improper Validation of Specified Quantity in InputBase

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

a010780a69754fc87c3828dcb17e709cb2615b9c352bc790b8e588259a0d2c0d

04 Affected products

VendorProductVersionsPlatforms

torprojectTor0.2.6.1-alpha to < 0.4.9.9—

05 References

gitlab.torproject.orghttps://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.9/ChangeLog