Reported uncontrolled resource consumption vulnerability in Arti onion services
A security report filed via HackerOne describes a vulnerability in Arti's onion-service implementation where invalid proof-of-work requests cause unbounded growth of persistent replay logs. The report states that an unauthenticated attacker can append approximately 16 bytes of data per request without solving the proof of work, potentially leading to filesystem exhaustion and service unavailability. The issue remains open in the Arti development tracker.
Why it matters
The report indicates that this vulnerability could allow an attacker to cause a denial of service against onion services by exhausting disk space, requiring operator intervention for recovery.
Event status Developing
Read the sources
- Uncontrolled persistent resource-consumption vulnerability gitlab.torproject.org
This is an AI-assisted summary of the linked public sources. Consult the original reports for details and operator guidance.