Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Tor Network: Unverified Rendezvous Node Connections Expose Circuit Information

CVE-2020-8516 · published 6 years ago
Summary

The Tor network is vulnerable to remote attackers discovering circuit information. This means an attacker could potentially gather sensitive information about how you're using the Tor network. Update to a version of Tor that fixes this issue to protect your anonymity.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
torproject tor <= 0.4.1.8
>= 0.4.2.0, <= 0.4.2.6
cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*
Original advisory text
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to ...
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published2 Feb 2020
Updated30 Oct 2026
First seen2 Apr 2026
Sources
CVE-2020-8516 · OSV
CVE-2020-8516 · NVD
Track software like this
Free during beta