CVE-2007-4099
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to...
CVE-2007-4099 is a medium vulnerability (CVSS 5.8) in Tor, published July 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in tor 0.1.2.15-1.
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
Exploit likelihood
What each source reports
NVD Score used
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
- Record
CVE-2007-4099- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
- Record
CVE-2007-4099- Updated
- 2026-11-02
EUVDEUVD-2007-4083 No score
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
- Record
EUVD-2007-4083- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvww-3pcr-wpmj No score
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to...
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
- Record
GHSA-hvww-3pcr-wpmj- Updated
- 2026-11-02
OSV No score
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
- Record
CVE-2007-4099- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4099 No score
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
- Record
DEBIAN-CVE-2007-4099- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |