🎯 New Report #3709703: Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache
🔺Severity: Low
👽 Reporter: geeknik
⭐️ Reputation: 5998
🛠 State: resolved
💼 Team: Tor
💵 Bounty: null
🕐 Submitted: 2026-05-02
⏰ Disclosed: 2026-09-10 12:10:33
📝 Summary: A vulnerability was discovered in Tor's onion service INTRODUCE2 handling. A remote client could send well-formed INTRODUCE1 cells with an invalid MAC, but a unique byte pattern. The introduction point would forward these cells as INTRODUCE2 to the onion service. The onion service would insert the attacker-controlled encrypted section into the introduction-point replay cache before verifying the INTRODUCE2 MAC. The replay cache was created with no expiration, allowing the attacker to grow it with unauthenticated data until memory pressure or out-of-memory.
📂 Report JSON File: 3709703
@hackeronereports