彙總 torproject 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 緩衝區溢位、記憶體損壞與輸入驗證問題 相關，可能在 生產負載與軟體部署 場景中帶來 記憶體損壞與檔案覆寫 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-44603 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. | [email protected] | 3.7 | 0.34% | 2026-05-07 | 2026-06-17 |
| CVE-2026-44602 | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006. | [email protected] | 3.7 | 0.33% | 2026-05-07 | 2026-06-17 |
| CVE-2026-44601 | Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009. | [email protected] | 3.7 | 0.34% | 2026-05-07 | 2026-06-17 |
| CVE-2026-44600 | Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. | [email protected] | 3.7 | 0.38% | 2026-05-06 | 2026-06-17 |
| CVE-2026-44599 | Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008. | [email protected] | 3.7 | 0.29% | 2026-05-06 | 2026-06-17 |
| CVE-2026-44597 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. | [email protected] | 3.7 | 0.45% | 2026-05-06 | 2026-06-17 |
| CVE-2023-23589 | The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002. | [email protected] | 6.5 | 0.78% | 2023-01-13 | 2026-06-17 |
| CVE-2022-33903 | Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation. | [email protected] | 7.5 | 1.06% | 2022-07-17 | 2026-06-17 |
| CVE-2021-46702 | Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn't properly free memory. | [email protected] | 5.5 | 0.39% | 2022-02-25 | 2026-06-17 |
| CVE-2021-39246 | Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network). | [email protected] | 6.1 | 0.46% | 2021-09-24 | 2026-06-17 |
| CVE-2021-38385 | Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007. | [email protected] | 7.5 | 1.69% | 2021-08-30 | 2026-06-17 |
| CVE-2021-34550 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor | [email protected] | 7.5 | 1.56% | 2021-06-29 | 2026-06-16 |
| CVE-2021-34549 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency. | [email protected] | 7.5 | 1.61% | 2021-06-29 | 2026-06-16 |
| CVE-2021-34548 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream. | [email protected] | 7.5 | 2.72% | 2021-06-29 | 2026-06-16 |
| CVE-2021-28090 | Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion failure, aka TROVE-2021-002. | [email protected] | 5.3 | 2.10% | 2021-03-19 | 2026-06-16 |
| CVE-2021-28089 | Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001. | [email protected] | 7.5 | 1.67% | 2021-03-19 | 2026-06-16 |
| CVE-2020-15572 | Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001. | [email protected] | 7.5 | 1.40% | 2020-07-15 | 2026-06-16 |
| CVE-2020-10593 | Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit. | [email protected] | 7.5 | 2.28% | 2020-03-23 | 2026-06-16 |
| CVE-2020-10592 | Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002. | [email protected] | 7.5 | 3.15% | 2020-03-23 | 2026-06-16 |
| CVE-2020-8516 | The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability | [email protected] | 5.3 | 2.50% | 2020-02-02 | 2026-06-16 |