{"id":"CVE-2025-4444","aliases":["DEBIAN-CVE-2025-4444","EUVD-2025-29912","GHSA-qc3c-vmf8-hgcj","MGASA-2026-0187","UBUNTU-CVE-2025-4444","openSUSE-SU-2025:15571-1"],"status":"published","title":"Tor Onion Service Descriptor resource consumption","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00475,"percentile":0.4134,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-404"],"published":"2025-09-18T13:58:52Z","modified":"2026-10-23T17:47:40Z","fixes":[{"ecosystem":"Debian:12","package":"tor","fixed_in":["0.4.9.6-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tor","fixed_in":["0.4.9.6-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tor","fixed_in":["0.4.8.21-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tor","fixed_in":["0.4.8.18-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.6-0+deb12u1"}]}],"versions":["0.4.7.13-1","0.4.7.16-1","0.4.8.10-1","0.4.8.10-1~bpo11+1","0.4.8.10-1~bpo12+1","0.4.8.11-1","0.4.8.11-1~bpo11+1","0.4.8.11-1~bpo12+1","0.4.8.12-1","0.4.8.12-1.1","0.4.8.12-1~bpo11+1","0.4.8.12-1~bpo12+1","0.4.8.13-1","0.4.8.13-2","0.4.8.13-2~bpo12+1","0.4.8.14-1","0.4.8.14-1~bpo12+1","0.4.8.16-1","0.4.8.21-1","0.4.8.21-1~bpo12+1","0.4.8.21-1~bpo13+1","0.4.8.21-1~bpo13+2","0.4.8.22-1","0.4.8.22-1~bpo12+1","0.4.8.22-1~bpo13+1","0.4.8.4-2","0.4.8.5-1","0.4.8.6-1","0.4.8.7-1","0.4.8.8-1","0.4.8.9-1","0.4.8.9-1~bpo11+1","0.4.8.9-1~bpo12+1","0.4.9.5-1","0.4.9.5-2","0.4.9.5-2~bpo12+1","0.4.9.5-2~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.6-0+deb13u1"}]}],"versions":["0.4.8.16-1","0.4.8.21-1","0.4.8.21-1~bpo12+1","0.4.8.21-1~bpo13+1","0.4.8.21-1~bpo13+2","0.4.8.22-1","0.4.8.22-1~bpo12+1","0.4.8.22-1~bpo13+1","0.4.9.5-1","0.4.9.5-2","0.4.9.5-2~bpo12+1","0.4.9.5-2~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8.21-1"}]}],"versions":["0.4.8.16-1","0.4.8.21-1~bpo12+1","0.4.8.21-1~bpo13+1","0.4.8.21-1~bpo13+2"]},{"source":"osv","ecosystem":"Mageia:9","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.9.8-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.3.25-1","0.2.4.19-1","0.2.4.20-1","0.2.4.27-1build0.14.04.1","0.2.4.27-1ubuntu0.1","0.2.4.27-1ubuntu0.1+esm1","0.2.4.27-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.6.10-1ubuntu2","0.2.7.6-1ubuntu1","0.2.9.11-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.1","0.2.9.14-1ubuntu1~16.04.2","0.2.9.14-1ubuntu1~16.04.3","0.2.9.14-1ubuntu1~16.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.0.10-1","0.3.1.8-2","0.3.1.9-1","0.3.2.9-1","0.3.2.9-1build1","0.3.2.10-1","0.3.2.10-1ubuntu0.1","0.3.2.10-1ubuntu0.2~esm1","0.3.2.10-1ubuntu0.2~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1.5-1","0.4.1.5-1build1","0.4.1.6-1","0.4.2.5-1","0.4.2.6-1","0.4.2.7-1","0.4.2.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.5.9-1","0.4.6.8-1","0.4.6.8-1build1","0.4.6.9-1","0.4.6.10-1","0.4.9.11-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.8.4-2","0.4.8.7-1","0.4.8.9-1","0.4.8.10-1","0.4.8.10-1build1","0.4.8.10-1build2","0.4.9.11-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.8.14-1","0.4.8.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.9.6-1","0.4.9.8-1","0.4.9.11-1","0.4.9.11-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.8.16-1","0.4.8.21-1","0.4.8.22-1","0.4.9.6-1","0.4.9.11-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8.18-1.1"}]}]}],"products":[{"vendor":"torproject","product":"tor"}],"references":[{"url":"https://vuldb.com/?id.324814","tags":["vdb-entry","web","report"]},{"url":"https://vuldb.com/?ctiid.324814","tags":["signature","permissions-required","web","report"]},{"url":"https://vuldb.com/?submit.640605","tags":["third-party-advisory","web","report"]},{"url":"https://github.com/chunmianwang/Tordos","tags":["related","package","report"]},{"url":"https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes","tags":["release-notes","web","report"]},{"url":"https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578","tags":["patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4444"},{"url":"https://github.com/advisories/GHSA-qc3c-vmf8-hgcj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-4444","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0187.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35486","tags":["report"]},{"url":"https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.8.25/ReleaseNotes?ref_type=tags#L5","tags":["web"]},{"url":"https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.8/ReleaseNotes?ref_type=tags#L5","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-4444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4444","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4444","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-4444","title":"Tor Onion Service Descriptor resource consumption","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T13:58:52.524Z","modified":"2025-09-18T20:41:21.835Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","level":"low","assessor":"cna"},{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","level":"low","assessor":"cna"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-400","CWE-404"],"updated_at":"2026-11-02T14:32:48.167635Z"}],"euvd":[{"id":"EUVD-2025-29912","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T13:58:52Z","modified":"2025-09-18T20:41:21Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium"}],"updated_at":"2026-11-02T20:31:41.781446Z"}],"ghsa":[{"id":"GHSA-qc3c-vmf8-hgcj","title":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown...","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T15:30:35Z","modified":"2025-09-18T15:30:44Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:03:39.228327Z"}],"nvd":[{"id":"CVE-2025-4444","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T14:15:49.887Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"secondary"}],"cwes":["CWE-400","CWE-404"],"updated_at":"2026-11-02T14:11:30.865098Z"}],"osv":[{"id":"CVE-2025-4444","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T14:15:49Z","modified":"2026-04-10T05:26:50.82537Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-4444","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T14:15:49.887Z","modified":"2026-10-23T17:47:40.940451533Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-4444","description":"A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.","status":"published","published":"2025-09-18T14:15:00Z","modified":"2026-10-17T12:57:03.149965443Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"MGASA-2026-0187","title":"Updated tor packages fix security issues","description":"This update provides lots of security issues fixed by upstream since our\ncurrent version.  Please see the links for details.\n","status":"published","published":"2026-06-10T05:07:06Z","modified":"2026-06-10T05:15:04.390643763Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15571-1","title":"tor-0.4.8.18-1.1 on GA media","description":"These are all security issues fixed in the tor-0.4.8.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-22T00:00:00Z","modified":"2026-03-23T04:53:56.963459Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}