A flaw in Tor before version 0.4.9.9 allows an attacker to bypass the built‑in compression bomb protection by concatenating many gzip or zlib sub‑streams, each just below the per‑stream threshold, thereby avoiding detection. This bypass can lead to excessive memory or resource consumption when decompressing network traffic, resulting in service disruption. The weakness is a failure to validate compressed data correctly (CWE‑420).

Tor versions earlier than 0.4.9.9 from the Tor Project. The vulnerability affects all Tor installations that execute inbound or outbound gzip or zlib streams, including relays and clients that process compressed data from the network. Updating to a release that pulls in the mitigation (0.4.9.9 or later) removes the flaw.

The CVSS score of 5.3 reflects a moderate severity that can cause denial of service in the absence of mitigations. No exploit has been reported (EPSS not available), and the vulnerability is not listed in CISA KEV. Attackers would need to supply malformed compressed payloads to a Tor instance; the attack vector is likely through network traffic that includes compressed data from untrusted peers. The risk is moderate for environments exposing Tor to unfiltered traffic, especially those with high connectivity to potentially hostile networks.