CVE-2007-1103
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers...
CVE-2007-1103 is a medium vulnerability (CVSS 4.3) in Tor, published February 26, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. No source names a fixed version.
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
Exploit likelihood
What each source reports
NVD Score used
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
- Record
CVE-2007-1103- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
- Record
CVE-2007-1103- Updated
- 2026-11-02
EUVDEUVD-2007-1100 No score
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
- Record
EUVD-2007-1100- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4r3h-7hr5-pjx6 No score
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers...
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
- Record
GHSA-4r3h-7hr5-pjx6- Updated
- 2026-11-02
OSV No score
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
- Record
CVE-2007-1103- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1103 No score
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
- Record
DEBIAN-CVE-2007-1103- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
All versions, plus listed versions 0.4.7.13-10.4.7.16-10.4.8.10-10.4.8.10-1~bpo11+10.4.8.10-1~bpo12+1 Show 45 moreShow less0.4.8.11-10.4.8.11-1~bpo11+10.4.8.11-1~bpo12+10.4.8.12-10.4.8.12-1.10.4.8.12-1~bpo11+10.4.8.12-1~bpo12+10.4.8.13-10.4.8.13-20.4.8.13-2~bpo12+10.4.8.14-10.4.8.14-1~bpo12+10.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+20.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.8.4-20.4.8.5-10.4.8.6-10.4.8.7-10.4.8.8-10.4.8.9-10.4.8.9-1~bpo11+10.4.8.9-1~bpo12+10.4.9.11-0+deb12u10.4.9.11-10.4.9.11-1~bpo13+10.4.9.12-20.4.9.12-30.4.9.12-40.4.9.13-10.4.9.14-10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb12u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-0+deb12u1 |
None known |
torDebian:13 |
All versions, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 29 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.11-0+deb13u10.4.9.11-10.4.9.11-1~bpo13+10.4.9.12-0+deb13u10.4.9.12-0+deb13u20.4.9.12-20.4.9.12-30.4.9.12-40.4.9.13-0+deb13u10.4.9.13-10.4.9.14-0+deb13u10.4.9.14-10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-0+deb13u10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-0+deb13u10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
None known |
torDebian:14 |
All versions, plus listed versions 0.4.8.16-10.4.8.21-10.4.8.21-1~bpo12+10.4.8.21-1~bpo13+10.4.8.21-1~bpo13+2 Show 22 moreShow less0.4.8.22-10.4.8.22-1~bpo12+10.4.8.22-1~bpo13+10.4.9.11-10.4.9.11-1~bpo13+10.4.9.12-20.4.9.12-30.4.9.12-40.4.9.13-10.4.9.14-10.4.9.5-10.4.9.5-20.4.9.5-2~bpo12+10.4.9.5-2~bpo13+10.4.9.6-10.4.9.6-1~bpo12+10.4.9.6-1~bpo13+10.4.9.8-10.4.9.8-1~bpo12+10.4.9.8-1~bpo13+10.4.9.9-10.4.9.9-1~bpo13+1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
archives.seul.org/or/talk/Feb-2007/msg00197.html
cs.colorado.edu/department/publications/reports/docs/CU-CS-1025-07.pdf
osvdb.org/45249
nvd.nist.gov/vuln/detail/CVE-2007-1103
github.com/advisories/GHSA-4r3h-7hr5-pjx6
security-tracker.debian.org/tracker/CVE-2007-1103
Left out here: 5 versions. The JSON record has them.