Torproject Tor vulnerabilities
107 known vulnerabilities affecting torproject/tor.
Total CVEs
107
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL8HIGH34MEDIUM63LOW2
Vulnerabilities
Page 6 of 6
CVE-2009-0936P4MEDIUMCVSS 5.0≥ 0, < 0.2.0.34-12009-03-18
CVE-2009-0936 [MEDIUM] CVE-2009-0936: Unspecified vulnerability in Tor before 0
Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via "corrupt votes."
osv
CVE-2011-4897P4MEDIUMCVSS 4.3≥ 0, < 0.2.2.27-beta-12011-12-23
CVE-2011-4897 [MEDIUM] CVE-2011-4897: Tor before 0
Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname value, which allows remote attackers to obtain potentially sensitive information by reading this value.
osv
CVE-2009-2425P4MEDIUMCVSS 5.0≥ 0, < 0.2.0.35-12009-07-10
CVE-2009-2425 [MEDIUM] CVE-2009-2425: Tor before 0
Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor.
osv
CVE-2006-3419P4MEDIUMCVSS 5.0≥ 0, < 0.1.1.20-12006-07-07
CVE-2006-3419 [MEDIUM] CVE-2006-3419: Tor before 0
Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.
osv
CVE-2025-4444P4MEDIUMCVSS 6.3≥ 0, < 0.4.9.6-0+deb12u1≥ 0, < 0.4.9.6-0+deb13u1+1 more2025-09-18
CVE-2025-4444 [MEDIUM] CVE-2025-4444: A security flaw has been discovered in Tor up to 0
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this
osv
CVE-2017-8822P4LOWCVSS 3.7≥ 0, < 0.3.1.9-12017-12-03
CVE-2017-8822 [LOW] CVE-2017-8822: In Tor before 0
In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incompletely downloaded descriptors) can pick themselves in a circuit path, leading to a degradation of anonymity, aka TROVE-2017-012.
osv
CVE-2011-0016P4LOWCVSS 2.1≥ 0, < 0.2.1.29-12011-01-19
CVE-2011-0016 [LOW] CVE-2011-0016: Tor before 0
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly manage key data in memory, which might allow local users to obtain sensitive information by leveraging the ability to read memory that was previously used by a different process.
osv
← Previous6 / 6