Torproject vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-77642 tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type.High 7.5 · Aug 20, 2026
• CVE-2026-77638 Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion servicHigh 8.9 · Aug 20, 2026
• CVE-2026-77584 Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams.High 7 · Aug 20, 2026
• CVE-2022-33903 Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.High 7.5 · Jul 17, 2022
• CVE-2021-38385 Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remoHigh 7.5 · Aug 30, 2021
• CVE-2021-34550 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006.High 7.5 · Jun 29, 2021
• CVE-2021-34549 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005.High 7.5 · Jun 29, 2021
• CVE-2021-34548 An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003.High 7.5 · Jun 29, 2021
• CVE-2021-28089 Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.High 7.5 · Mar 19, 2021
• CVE-2020-15572 Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network SHigh 7.5 · Jul 15, 2020
• CVE-2020-10593 Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004.High 7.5 · Mar 23, 2020
• CVE-2020-10592 Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002High 7.5 · Mar 23, 2020
• CVE-2019-8955 In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relaysHigh 7.5 · Feb 21, 2019
• CVE-2018-0491 A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10.High 7.5 · Mar 5, 2018
• CVE-2018-0490 An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10.High 7.5 · Mar 5, 2018
• CVE-2016-1254 Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.High 7.5 · Dec 5, 2017
• CVE-2017-0377 Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers toHigh 7.5 · Jul 2, 2017
• CVE-2017-0376 The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell functiHigh 7.5 · Jun 9, 2017
• CVE-2017-0375 The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function vHigh 7.5 · Jun 9, 2017
• CVE-2016-8860 Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementatHigh 7.5 · Jan 4, 2017