Log in Start free

Vulnerability · Published Sep 18, 2025 · Assigned by VulDB

CVE-2025-4444Tor Onion Service Descriptor resource consumption

Low 3.7

In plain English

A low-severity uncontrolled resource consumption in Tor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tor0.4.9.6-0+deb12u1DEBIAN-CVE-2025-4444
Debian:13tor0.4.9.6-0+deb13u1DEBIAN-CVE-2025-4444
Debian:14tor0.4.8.21-1DEBIAN-CVE-2025-4444
Ubuntu:22.04:LTStorno fix listedUBUNTU-CVE-2025-4444
Ubuntu:24.04:LTStorno fix listedUBUNTU-CVE-2025-4444
Ubuntu:25.10torno fix listedUBUNTU-CVE-2025-4444
Ubuntu:26.04:LTStorno fix listedUBUNTU-CVE-2025-4444
Ubuntu:26.10torno fix listedUBUNTU-CVE-2025-4444

Affected products (as reported)

VendorProductVersions
n/a Tor 0.4.7.00.4.7.10.4.7.20.4.7.30.4.7.40.4.7.50.4.7.60.4.7.7

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References