Torproject Tor vulnerabilities
107 known vulnerabilities affecting torproject/tor.
Total CVEs
107
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL8HIGH34MEDIUM63LOW2
Vulnerabilities
Page 3 of 6
CVE-2017-8820P4HIGHCVSS 7.5≥ 0, < 0.3.1.9-12017-12-03
CVE-2017-8820 [HIGH] CVE-2017-8820: In Tor before 0
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service (NULL pointer dereference and application crash) against directory authorities via a malformed descriptor, aka TROVE-2017-010.
osv
CVE-2022-33903P4HIGHCVSS 7.5≥ 0.4.7.1, < 0.4.7.82022-07-17
CVE-2022-33903 [HIGH] CVE-2022-33903: Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.
Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.
nvdosv
CVE-2015-2929P4HIGHCVSS 7.5fixed in 0.2.4.27≥ 0.2.5.1, < 0.2.5.12+1 more2020-01-24
CVE-2015-2929 [HIGH] CVE-2015-2929: The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
nvdosv
CVE-2006-3412P4MEDIUMCVSS 6.4≥ 0, < 0.1.1.20-12006-07-07
CVE-2006-3412 [MEDIUM] CVE-2006-3412: Tor before 0
Tor before 0.1.1.20 does not sufficiently obey certain firewall options, which allows remote attackers to bypass intended access restrictions for dirservers, direct connections, or proxy servers.
osv
CVE-2009-0939P4CRITICALCVSS 10.0≥ 0, < 0.2.0.34-12009-03-18
CVE-2009-0939 [CRITICAL] CVE-2009-0939: Tor before 0
Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.
osv
CVE-2021-28090P4MEDIUMCVSS 5.3fixed in 0.3.5.14≥ 0.4.4.4, < 0.4.4.8+5 more2021-03-19
CVE-2021-28090 [MEDIUM] CWE-617 CVE-2021-28090: Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an asser
Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.
nvdosv
CVE-2026-77639P4MEDIUMCVSS 5.3fixed in 0.4.9.9≥ 0.3.1.1-alpha, < 0.4.9.92026-08-20
CVE-2026-77639 [MEDIUM] CWE-420 CVE-2026-77639: Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many g
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.
nvd
CVE-2023-23589P4MEDIUMCVSS 6.5fixed in 0.4.7.132023-01-14
CVE-2023-23589 [MEDIUM] CWE-693 CVE-2023-23589: The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol ca
The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
nvdosv
CVE-2014-5117P4MEDIUMCVSS 5.8≤ 0.2.4.22v0.0.2+107 more2014-07-30
CVE-2014-5117 [MEDIUM] CVE-2014-5117: Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.
nvdosv
CVE-2017-0380P4MEDIUMCVSS 5.9≤ 0.2.8.14v0.2.9.0+28 more2017-09-18
CVE-2017-0380 [MEDIUM] CWE-532 CVE-2017-0380: The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x befo
The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitializ
nvdosv
CVE-2020-8516P4MEDIUMCVSS 5.3≤ 0.4.1.8≥ 0.4.2.0, ≤ 0.4.2.62020-02-02
CVE-2020-8516 [MEDIUM] CVE-2020-8516: The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
nvd
CVE-2026-44599P4MEDIUMCVSS 5.3fixed in 0.4.9.72026-05-07
CVE-2026-44599 [MEDIUM] CWE-669 CVE-2026-44599: Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
nvd
CVE-2026-77640P4MEDIUMCVSS 5.3fixed in 0.4.9.9≥ 0.2.6.1-alpha, < 0.4.9.92026-08-20
CVE-2026-77640 [MEDIUM] CWE-1284 CVE-2026-77640: tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream wi
tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so t
nvd
CVE-2007-4098P4MEDIUMCVSS 5.8≥ 0, < 0.1.2.15-12007-07-30
CVE-2007-4098 [MEDIUM] CVE-2007-4098: Tor before 0
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
osv
CVE-2026-44600P4MEDIUMCVSS 5.3fixed in 0.4.9.72026-05-07
CVE-2026-44600 [MEDIUM] CWE-696 CVE-2026-44600: Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a
Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.
nvd
CVE-2008-5397P4HIGHCVSS 7.2≥ 0, < 0.2.0.32-12008-12-09
CVE-2008-5397 [HIGH] CVE-2008-5397: Tor before 0
Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.
osv
CVE-2006-3417P4MEDIUMCVSS 6.4≥ 0, < 0.1.1.20-12006-07-07
CVE-2006-3417 [MEDIUM] CVE-2006-3417: Tor client before 0
Tor client before 0.1.1.20 prefers entry points based on is_fast or is_stable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" (is_guard) systems by directory authorities.
osv
CVE-2006-3407P4MEDIUMCVSS 6.4≥ 0, < 0.1.1.20-12006-07-07
CVE-2006-3407 [MEDIUM] CVE-2006-3407: Tor before 0
Tor before 0.1.1.20 allows remote attackers to spoof log entries or possibly execute shell code via strings with non-printable characters.
osv
CVE-2011-0015P4MEDIUMCVSS 5.0≥ 0, < 0.2.1.29-12011-01-19
CVE-2011-0015 [MEDIUM] CVE-2011-0015: Tor before 0
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly check the amount of compression in zlib-compressed data, which allows remote attackers to cause a denial of service via a large compression factor.
osv
CVE-2011-2768P4MEDIUMCVSS 5.8≥ 0, < 0.2.2.34-12011-12-23
CVE-2011-2768 [MEDIUM] CVE-2011-2768: Tor before 0
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.
osv