Torproject Tor vulnerabilities

CVE-2018-0491 [HIGH] CWE-416 CVE-2018-0491: A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.

CVE-2007-4174 [MEDIUM] CVE-2007-4174: Tor before 0 Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.

CVE-2010-1676 [CRITICAL] CVE-2010-1676: Heap-based buffer overflow in Tor before 0 Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.

CVE-2026-44603 [CRITICAL] CWE-193 CVE-2026-44603: Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026- Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

CVE-2026-77638 [HIGH] CWE-362 CVE-2026-77638: Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.

CVE-2026-77642 [CRITICAL] CWE-787 CVE-2026-77642: tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signatu tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

CVE-2026-44597 [CRITICAL] CWE-684 CVE-2026-44597: Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a re Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

CVE-2017-0377 [HIGH] CWE-200 CVE-2017-0377: Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

CVE-2021-34548 [HIGH] CWE-290 CVE-2021-34548: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END o An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.

CVE-2021-28089 [HIGH] CWE-400 CVE-2021-28089: Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resource Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

CVE-2026-77641 [HIGH] CWE-252 CVE-2026-77641: tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. Th tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a

CVE-2011-2778 [HIGH] CVE-2011-2778: Multiple heap-based buffer overflows in Tor before 0 Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.

CVE-2017-11565 [HIGH] CVE-2017-11565: debian/tor debian/tor.init in the Debian tor_0.2.9.11-1~deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly (with a wrong assumption that the specific pathname would remain the same forever), which allows attackers to bypass intended AppArmor restrictions by leveraging the silent loss of this protection mechanism. NOTE: this does not affect systems, suc

CVE-2026-44601 [HIGH] CWE-837 CVE-2026-44601: Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.

CVE-2017-8823 [HIGH] CVE-2017-8823: In Tor before 0 In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free in onion service v2 during intro-point expiration because the expiring list is mismanaged in certain error cases, aka TROVE-2017-013.

CVE-2021-34549 [HIGH] CWE-400 CVE-2021-34549: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.

CVE-2008-5398 [CRITICAL] CVE-2008-5398: Tor before 0 Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination hostname of a refused stream.

CVE-2026-77584 [HIGH] CWE-821 CVE-2026-77584: Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has a Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit

CVE-2015-2689 [HIGH] CWE-20 CVE-2015-2689: Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.

CVE-2016-8860 [HIGH] CWE-119 CVE-2016-8860: Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to exp Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted dat