Browse CVEs

CRITICAL 9.1 CVE-2026-44603 Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. Tor 0.4.9.7+ Fix from $2,3002026-05-07 HIGH 7.5 CVE-2026-44601 Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-0… Tor 0.4.9.7+ Fix from $1,9502026-05-07 HIGH 7.5 CVE-2026-44602 Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006. Tor 0.4.9.7+ Fix from $1,9502026-05-07 MEDIUM 5.3 CVE-2026-44600 Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. Tor 0.4.9.7+ Fix from $1,6002026-05-07 MEDIUM 5.3 CVE-2026-44599 Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008. Tor 0.4.9.7+ Fix from $1,6002026-05-07 CRITICAL 9.1 CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. Tor 0.4.9.7+ Fix from $2,3002026-05-07 HIGH 7.5 CVE-2022-33903 Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation. Tor 0.4.7.8+ Fix from $1,9502022-07-17 MEDIUM 5.5 CVE-2021-46702 Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymit… Tor Mitigation only Fix from $1,6002022-02-26 MEDIUM 6.1 CVE-2021-39246 Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact… Tor Browser after 10.5.6 Fix from $1,6002021-09-24 HIGH 7.5 CVE-2021-38385 Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leadin… Tor 0.3.5.16 / 0.4.5.10+ Fix from $1,9502021-08-30 HIGH 7.5 CVE-2021-34549 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an atta… Tor 0.3.5.15 / 0.4.4.9+ Fix from $1,9502021-06-29 HIGH 7.5 CVE-2021-34550 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a … Tor 0.3.5.15 / 0.4.4.9+ Fix from $1,9502021-06-29 HIGH 7.5 CVE-2021-34548 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access co… Tor 0.3.5.15 / 0.4.4.9+ Fix from $1,9502021-06-29 HIGH 7.5 CVE-2020-15572 Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozill… Tor 0.3.5.11 / 0.4.2.8+ Fix from $1,9502020-07-15 HIGH 7.5 CVE-2020-10593 Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2… Tor 0.3.5.10 / 0.4.1.9+ Fix from $1,9502020-03-23 HIGH 7.5 CVE-2020-10592 Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TRO… Tor 0.3.5.10 / 0.4.1.9+ Fix from $1,9502020-03-23 MEDIUM 5.3 CVE-2020-8516 The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, whi… Tor after 0.4.2.6 Fix from $1,6002020-02-02 HIGH 7.5 CVE-2015-2688 buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, whic… Tor 0.2.4.26 / 0.2.5.11+ Fix from $1,9502020-01-24 HIGH 7.5 CVE-2015-2689 Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which all… Tor 0.2.4.26 / 0.2.5.11+ Fix from $1,9502020-01-24 HIGH 7.5 CVE-2015-2928 The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to … Tor 0.2.4.27 / 0.2.5.12+ Fix from $1,9502020-01-24 HIGH 7.5 CVE-2015-2929 The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to ca… Tor 0.2.4.27 / 0.2.5.12+ Fix from $1,9502020-01-24 MEDIUM 5.3 CVE-2019-13075 Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involvin… Tor Browser after 8.5.3 Fix from $1,6002019-06-30 HIGH 7.5 CVE-2019-8955 In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients… Tor 0.3.3.12 / 0.3.4.11+ Fix from $1,9502019-02-21 HIGH 7.5 CVE-2018-0491EPSS 15% A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because t… Tor 0.3.2.10+ Fix from $1,9502018-03-05 MEDIUM 5.9 CVE-2017-0380 The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x bef… Tor after 0.2.8.14 Fix from $1,6002017-09-18 HIGH 7.5 CVE-2017-0377 Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote a… Tor Patch available Fix from $1,9502017-07-02 HIGH 7.5 CVE-2017-0375 The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_… Tor 0.3.0.8+ Fix from $1,9502017-06-09 HIGH 7.5 CVE-2016-8860 Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the … Tor after 0.2.8.8 Fix from $1,9502017-01-04 MEDIUM 5.8 CVE-2014-5117 Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easi… Tor after 0.2.4.22 Fix from $1,6002014-07-30 MEDIUM 5.0 CVE-2012-2249 Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occu… Tor after 0.2.3.22 Fix from $1,6002014-02-03