← volver
CVE-2025-4444

Tor Onion Service Descriptor resource consumption

CVSS 6.3 MEDIUMEPSS 0.4%CWE-400CWE-404
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
18 sep 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Productos afectados
n/a · Tor

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578https://github.com/chunmianwang/Tordoshttps://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNoteshttps://vuldb.com/?ctiid.324814https://vuldb.com/?id.324814https://vuldb.com/?submit.640605