Every CVE Search/ Get API key

CVE-2020-10592

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to...

7.5 HighFix available

CVE-2020-10592 is a high vulnerability (CVSS 7.5) in Torproject Tor, published March 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. Fixed in tor 0.3.5.10-r0.

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.23%Up 1.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
CVE-2020-10592
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Updated
2026-11-02
CVE List No score

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
CVE-2020-10592
Updated
2026-11-02
EUVDEUVD-2020-3042 No score

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
EUVD-2020-3042
Updated
2026-11-03
GitHub AdvisoriesGHSA-7rpw-j92m-2vr2 No score

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to...

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
GHSA-7rpw-j92m-2vr2
Weakness
CWE-400
Updated
2026-11-02
OSVALPINE-CVE-2020-10592 7.5

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
ALPINE-CVE-2020-10592
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 7.5

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
CVE-2020-10592
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2020-10592 7.5

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
DEBIAN-CVE-2020-10592
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-10592 7.5

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-002.

Record
UBUNTU-CVE-2020-10592
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2020-0165 No score

Updated tor packages fix security vulnerabilities

Updated tor package fixes security vulnerabilities:

Tor before 0.3.5.10 allows remote attackers to cause a Denial of Service (CPU consumption) (CVE-2020-10592).

Tor before 0.3.5.10 allows remote attackers to cause a Denial of Service (memory leak). This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit (CVE-2020-10593).

Record
MGASA-2020-0165
Updated
2026-11-02
OSVopenSUSE-SU-2020:0406-1 No score

Security update for tor

This update for tor to version 0.3.5.10 fixes the following issues:

  • tor was updated to version 0.3.5.10:

  • CVE-2020-10592: Fixed a CPU consumption denial of service and timing patterns (boo#1167013)

  • CVE-2020-10593: Fixed a circuit padding memory leak (boo#1167014)

Record
openSUSE-SU-2020:0406-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0428-1 No score

Security update for tor

This update for tor to version 0.3.5.10 fixes the following issues:

  • tor was updated to version 0.3.5.10:

  • CVE-2020-10592: Fixed a CPU consumption denial of service and timing patterns (boo#1167013)

  • CVE-2020-10593: Fixed a circuit padding memory leak (boo#1167014)

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record
openSUSE-SU-2020:0428-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1970-1 No score

Security update for tor

This update for tor fixes the following issues:

Updating tor to a newer version in the respective codestream.

  • tor 0.3.5.12:

    • Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)
    • Not affected by out-of-bound memory access (CVE-2020-15572, boo#1173979)
    • Fix DoS defenses on bridges with a pluggable transport
    • CVE-2020-10592: CPU consumption DoS and timing patterns (boo#1167013)
    • CVE-2020-10593: circuit padding memory leak (boo#1167014)

  • tor 0.4.4.6

    • Check channels+circuits on relays more thoroughly (TROVE-2020-005, boo#1178741)
    • Fix a crash due to an out-of-bound memory access (CVE-2020-15572, boo#1173979)
    • Fix logrotate to not fail when tor is stopped (boo#1164275)
Record
openSUSE-SU-2020:1970-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11469-1 No score

tor-0.4.6.7-2.2 on GA media

These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11469-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tor
Alpine:v3.10
 0.3.5 up to 0.3.5.10-r0
0.3.5.10-r0
tor
Alpine:v3.11
 0.3.5 up to 0.4.4.9-r0
0.4.4.9-r0
tor
Alpine:v3.12
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.13
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.14
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.15
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.16
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.17
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.18
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.19
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
Show 18 moreShow less
Affected packages
PackageAffectedFixed
tor
Alpine:v3.20
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.21
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.22
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.23
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Alpine:v3.24
 0.3.5 up to 0.4.2.7-r0
0.4.2.7-r0
tor
Debian:12
 before 0.4.2.7-1
0.4.2.7-1
tor
Debian:13
 before 0.4.2.7-1
0.4.2.7-1
tor
Debian:14
 before 0.4.2.7-1
0.4.2.7-1
tor
Debian:10
 before 0.3.5.10-1, plus listed versions
0.3.5.10-1~bpo9+10.3.5.8-1
0.3.5.10-1
tor
Mageia:7
 before 0.3.5.10-1.mga7
0.3.5.10-1.mga7
tor
openSUSE:Leap 15.1
 before 0.3.5.10-lp151.2.3.1
0.3.5.10-lp151.2.3.1
tor
SUSE:Package Hub 15 SP1
 before 0.3.5.10-bp151.3.3.1
0.3.5.10-bp151.3.3.1
tor
SUSE:Package Hub 12
 before 0.4.4.6-bp152.2.3.1
0.4.4.6-bp152.2.3.1
tor
SUSE:Package Hub 15 SP1
 before 0.4.4.6-bp152.2.3.1
0.4.4.6-bp152.2.3.1
tor
SUSE:Package Hub 15 SP2
 before 0.4.4.6-bp152.2.3.1
0.4.4.6-bp152.2.3.1
tor
openSUSE:Leap 15.1
 before 0.4.4.6-bp152.2.3.1
0.4.4.6-bp152.2.3.1
tor
openSUSE:Leap 15.2
 before 0.4.4.6-bp152.2.3.1
0.4.4.6-bp152.2.3.1
tor
openSUSE:Tumbleweed
 before 0.4.6.7-2.2
0.4.6.7-2.2

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-03affected
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open