Hi, relays receive this warning from time to time. It happens if an actor spoofes directory authority ips and sends crafted packed data. Tor detects that and handles it accordingly. Nothing to worry about.
There is a little more information available here on the prevalence of the issue:
No one really knows what the intended purpose is. On the surface, of course, what it is is a specially crafted set of compressed data that expands to something far far larger than the memory it takes to send it. Generally a compression bomb is used as part of an asymmetric DoS attack to try and make you expend resources (memory, disk space) far in excess of the impact of the size of the data used. That said, there has been detection and protection against this attack for some time and why someone would expend resources on this kind of attack attempt doesn’t make a whole lot of sense.
It could be the same sort of thing behind the repeated “bash their head against the wall” ssh attempts we all see on our ssh services. It could, and probably is, nothing more complicated than a script-kiddy with some old dark-web copy of a malicious tor relay codebase who thinks he’s really badass running it. No one really knows. But people are seeing it happen more recently in new and unusual ways, and so there may be someone trying new malicious tor code out for size.
tor is very robust, but I wouldn’t say it’s necessarily something to dismiss out of hand. If it starts happening a lot, or in new circumstances, it may be useful to report.
