Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Tor client may crash when contacting malformed hidden service

CVE-2015-2929 · published 6 years ago
Summary

If you run Tor versions prior to 0.2.4.27, 0.2.5.12, or 0.2.6.7, a specially crafted hidden service description can make the Tor program stop working. This means a remote site could temporarily shut down the Tor client on your system. Upgrade to the latest Tor release to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
torproject tor < 0.2.4.27
>= 0.2.5.1, < 0.2.5.12
>= 0.2.6.1, < 0.2.6.7
cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*
Original advisory text
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and a...
The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published24 Jan 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-2929 · NVD
Track software like this
Free during beta