Tor relay denial of service
I found a strange behavior in Tor relays that allow me to make a remote Tor relay crash or at least have a 100 % CPU usage. It crashes only if it is possible to send more data than RAM (and swap) can store in 300 s (5 minutes) to the relay.
Proof of concept attached to this ticket. I have not tested this myself.