CVE-2025-4444

Tor Onion Service Descriptor resource consumption

State: Published
Severity: 6.3 Medium
Published: Sep 18, 2025
Updated: Sep 18, 2025
Reserved: May 8, 2025

Description

A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-400 Resource Consumption
CWE-404 Denial of Service

Affected Products

Product	Versions
Torn/a	0.4.7.0Affected 0.4.7.1Affected 0.4.7.2Affected 0.4.7.3Affected 0.4.7.4Affected 0.4.7.5Affected 0.4.7.6Affected 0.4.7.7Affected 0.4.7.8Affected 0.4.7.9Affected 0.4.7.10Affected 0.4.7.11Affected 0.4.7.12Affected 0.4.7.13Affected 0.4.7.14Affected 0.4.7.15Affected 0.4.7.16Affected 0.4.8.0Affected 0.4.8.1Affected 0.4.8.2Affected 0.4.8.3Affected 0.4.8.4Affected 0.4.8.5Affected 0.4.8.6Affected 0.4.8.7Affected and 12 more versions

Product

Versions

Torn/a

0.4.7.0Affected
0.4.7.1Affected
0.4.7.2Affected
0.4.7.3Affected
0.4.7.4Affected
0.4.7.5Affected
0.4.7.6Affected
0.4.7.7Affected
0.4.7.8Affected
0.4.7.9Affected
0.4.7.10Affected
0.4.7.11Affected
0.4.7.12Affected
0.4.7.13Affected
0.4.7.14Affected
0.4.7.15Affected
0.4.7.16Affected
0.4.8.0Affected
0.4.8.1Affected
0.4.8.2Affected
0.4.8.3Affected
0.4.8.4Affected
0.4.8.5Affected
0.4.8.6Affected
0.4.8.7Affected
and 12 more versions

References

VDB-324814 | Tor Onion Service Descriptor resource consumptionvdb-entry
VDB-324814 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
Submit #640605 | Tor ≤ 0.4.8 Memory Management vulnerabilitythird-party-advisory
https://github.com/chunmianwang/Tordosrelated
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotesrelease-notes
https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.