The CVSS 5.3 rating misrepresents this vulnerability's severity because it applies standard risk metrics to a system whose threat model explicitly includes nation-state adversaries with cryptographic sophistication—the exact actors most capable of exploiting compression oracle techniques. The core issue isn't that the per-stream threshold was too high; it's that threshold-based detection is structurally incapable of handling gzip/zlib concatenation, a known property of these formats. An attacker who understands stream structure can arbitrarily extend decompression ratios by simply chaining sub-streams below any fixed threshold. This isn't a bug in the check—it's a category error in how the defense was designed.
The gzip format exposes a stream-of-streams structure through its API: deflateInit through deflateEnd operates on a single logical stream, but concatenated members are valid, separate streams that the API treats identically to the first. Developers working with compression libraries develop a mental model where "compression object equals logical stream"—a metaphor the format itself never guarantees. The detection mechanism wasn't naive; it was designed with reasonable assumptions about how compression gets used, based on an API that makes concatenation behavior invisible by default. This is a recurring pattern in security-sensitive protocol implementation: the library API creates cognitive shortcuts that protocol designers follow, even when adversarial conditions invalidate those shortcuts.
For most software, a compression bomb bypass might be concerning but not critical. Tor operates differently. The primary adversaries of Tor users—journalists, activists, dissidents, and researchers under authoritarian regimes—face opponents with deep technical resources and strong motivation to extract identifying information. A 5.3 CVSS score assumes opportunistic attackers and commodity impact; the actual threat landscape is adversarial and high-stakes.
The fix in 0.4.9.9 presumably moves beyond per-stream counting toward aggregate ratio tracking or byte-count limits across concatenated streams. The critical question for analysts is whether this fix addresses the concatenation vector specifically or merely increases the threshold (which would remain gameable). More importantly, this CVE exposes a detection mechanism built on assumptions that don't hold under adversarial review. The EPSS score of 0.00246 suggests low exploitability in the short term, but for a network anonymity system, the long-term cryptanalytic implications matter more than short-term exploit prevalence.
This is the third major iteration of the same compression-bomb pattern. First came naïve ratio checks, then smarter per-entry or per-stream limits—the pattern that failed here. The attack moved up one level in the format hierarchy to concatenated members that the API treats as invisible by design. The fix in 0.4.9.9 will be bypassed again the moment someone finds the next structural invariant the library exposes but the developer doesn't see. The zlib or gzip library has no mechanism to expose member boundaries to the caller; it returns an opaque stream that the caller iterates until EOF. Any application using the standard API is structurally blind to the concatenation attack, not because developers are careless, but because the library architecture makes the attack invisible by design.
The detection logic didn't fail—it was fossilized. Written once, deemed sufficient, then carried forward without active maintenance or threat model review as the gzip specification, Tor's protocol, and compression oracle research all evolved independently. The concatenated-stream property of gzip has been documented since the 1990s. If the check had been under active maintenance, this would have been in the threat model. The fix in 0.4.9.9 will itself become forgotten code. Aggregate ratio tracking introduces new assumptions—byte-count limits assume finite input, concatenated-stream handling assumes particular gzip member boundaries—that will also erode as the codebase evolves. The entropy doesn't stop. The question is: who owns the maintenance of the new defense, and under what conditions will they notice when the next format property makes their assumptions invisible?
The institutional failure extends beyond Tor. CVE databases, threat model templates, and security review processes have repeatedly failed to encode concatenated-gzip handling as a known pitfall, despite the property being documented in RFC 1952 (1996) and zlib documentation explicitly noting that concatenated members are valid. Each generation of developers has to rediscover that the format they think they understand has a stream-of-streams structure baked into its design. The EPSS score measures short-term exploit prevalence—it tells you nothing about the duration of exposure, and for a vulnerability whose bypass vector has been documented since the 1990s, that duration is the actual measure of systemic debt. Tor relays have been running versions with this bypass for years. That's not an acute exposure window; it's chronic, compounding debt.