In a nutshell, the flow control algorithm was designed with trustworthy peers in mind and buffering on a node was controlled by signals sent by its peers. This

In a nutshell, the flow control algorithm was designed with trustworthy peers in mind and buffering on a node was controlled by signals sent by its peers. This allowed a misbehaving peer to spam buffer commands, exhausting available memory on the target node. An attacker who carefully chose their targets could force a TOR user to use a specific route, thereby de-anonymizing them. Really just seems like TOR's version of slowloris. I'm rather disappointed they didn't call it slowtoris.