Torproject Tor

Tor before 0.4.9.7 OOB Read via Malformed BEGIN Cell
CVE-2026-44603 3.7 - Low - May 07, 2026

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007.

off-by-five

Tor <0.4.9.7 NULL Pointer Deref on CERT cell out-of-order
CVE-2026-44602 3.7 - Low - May 07, 2026

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

NULL Pointer Dereference

Tor 0.4.9.x DoubleClose Client Crash due to Circuit Queue Pressure
CVE-2026-44601 3.7 - Low - May 07, 2026

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.

Improper Enforcement of a Single, Unique Action

Tor 0.4.9.6 Conflux Queue Accounting Flaw
CVE-2026-44600 3.7 - Low - May 07, 2026

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.

Incorrect Behavior Order

Tor <=0.4.9.6 BEGIN_DIR Conflux Legs Vulnerability (CVE-2026-44599)
CVE-2026-44599 3.7 - Low - May 07, 2026

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

Incorrect Resource Transfer Between Spheres

Tor 0.4.9.7 < OOB Read on END/TRUNCATE cells lacking reason (TROVE-2026-011)
CVE-2026-44597 3.7 - Low - May 07, 2026

Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

Incorrect Provision of Specified Functionality

Tor v0.4.8.17 Onion Service Descriptor Handler Resource Exhaustion
CVE-2025-4444 3.7 - Low - September 18, 2025

A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.

Resource Exhaustion

Logic Error in Tor SafeSocks Enables Unsafe SOCKS4 <0.4.7.13
CVE-2023-23589 6.5 - Medium - January 14, 2023

The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.

Tor 0.4.7.x before 0.4.7.8
CVE-2022-33903 7.5 - High - July 17, 2022

Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.

Tor before 0.3.5.16
CVE-2021-38385 7.5 - High - August 30, 2021

Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007.

assertion failure

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006
CVE-2021-34550 7.5 - High - June 29, 2021

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor

Buffer Overflow

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005
CVE-2021-34549 7.5 - High - June 29, 2021

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.

Resource Exhaustion

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003
CVE-2021-34548 7.5 - High - June 29, 2021

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream.

Authentication Bypass by Spoofing

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure
CVE-2021-28090 5.3 - Medium - March 19, 2021

Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002.

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target
CVE-2021-28089 7.5 - High - March 19, 2021

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

Resource Exhaustion

Tor before 0.4.3.6 has an out-of-bounds memory access
CVE-2020-15572 7.5 - High - July 15, 2020

Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.

Buffer Overflow

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7
CVE-2020-10593 7.5 - High - March 23, 2020

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.

Memory Leak

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7
CVE-2020-10592 7.5 - High - March 23, 2020

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify
CVE-2020-8516 - February 02, 2020

The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability

In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur
CVE-2019-8955 - February 21, 2019

In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.

An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10
CVE-2018-0490 7.5 - High - March 05, 2018

An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting.

NULL Pointer Dereference

A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10
CVE-2018-0491 7.5 - High - March 05, 2018

A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.

Dangling pointer