CVE-2026-87724
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 09, 2026
Vendor
unknown
Description
Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032.