A flaw in Tor before version 0.4.9.9 causes an infinite loop when decompressing a truncated zlib/gzip stream set with done=1. The decompression routine misinterprets a Z_BUF_ERROR as a full output buffer and repeatedly retries, never exiting the loop. This non‑terminating process consumes CPU resources, potentially disrupting the Tor instance and the host it runs on. The weakness is classified as CWE‑1284, indicating resource exhaustion.

The vulnerability affects the Tor project’s Tor software, specifically any deployment running a version earlier than 0.4.9.9. It is not limited to a particular operating system or installation method; any Tor node that performs zlib/gzip decompression of network traffic is susceptible.

The CVSS score of 3.7 reflects a low to moderate risk; the EPSS score is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can likely trigger the fault remotely by sending malformed compressed data over Tor, which would cause the targeted node to enter an infinite loop. Because the issue arises during normal packet handling, an adversary with network access to a Tor node could cause a denial of service with minimal effort. The lack of a CVE‐specific patch handling mechanism means the only effective mitigation is to update to a fixed release or apply resource controls to limit the impact.