CVE-2025-4444
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2025-09-18 14:15:49.887000
Last modified
2026-10-19 16:10:00.260000
View original CVE JSON
{
"id": "CVE-2025-4444",
"sourceIdentifier": "[email protected]",
"published": "2025-09-18T14:15:49.887",
"lastModified": "2026-10-19T16:10:00.260",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tor up to 0.4.7.16/0.4.8.17. Impacted is an unknown function of the component Onion Service Descriptor Handler. Performing manipulation results in resource consumption. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. Upgrading to version 0.4.8.18 and 0.4.9.3-alpha is recommended to address this issue. It is recommended to upgrade the affected component."
},
{
"lang": "es",
"value": "Una falla de seguridad ha sido descubierta en Tor hasta la versión 0.4.7.16/0.4.8.17. Se ve afectada una función desconocida del componente Gestor de Descriptores de Servicio Onion. Realizar una manipulación provoca consumo de recursos. El ataque puede ser iniciado remotamente. La complejidad del ataque se califica como alta. La explotabilidad se considera difícil. Se recomienda actualizar a la versión 0.4.8.18 y 0.4.9.3-alpha para abordar este problema. Se recomienda actualizar el componente afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "Tor",
"modules": [
"Onion Service Descriptor Handler"
],
"versions": [
{
"version": "0.4.7.0",
"status": "affected"
},
{
"version": "0.4.7.1",
"status": "affected"
},
{
"version": "0.4.7.2",
"status": "affected"
},
{
"version": "0.4.7.3",
"status": "affected"
},
{
"version": "0.4.7.4",
"status": "affected"
},
{
"version": "0.4.7.5",
"status": "affected"
},
{
"version": "0.4.7.6",
"status": "affected"
},
{
"version": "0.4.7.7",
"status": "affected"
},
{
"version": "0.4.7.8",
"status": "affected"
},
{
"version": "0.4.7.9",
"status": "affected"
},
{
"version": "0.4.7.10",
"status": "affected"
},
{
"version": "0.4.7.11",
"status": "affected"
},
{
"version": "0.4.7.12",
"status": "affected"
},
{
"version": "0.4.7.13",
"status": "affected"
},
{
"version": "0.4.7.14",
"status": "affected"
},
{
"version": "0.4.7.15",
"status": "affected"
},
{
"version": "0.4.7.16",
"status": "affected"
},
{
"version": "0.4.8.0",
"status": "affected"
},
{
"version": "0.4.8.1",
"status": "affected"
},
{
"version": "0.4.8.2",
"status": "affected"
},
{
"version": "0.4.8.3",
"status": "affected"
},
{
"version": "0.4.8.4",
"status": "affected"
},
{
"version": "0.4.8.5",
"status": "affected"
},
{
"version": "0.4.8.6",
"status": "affected"
},
{
"version": "0.4.8.7",
"status": "affected"
},
{
"version": "0.4.8.8",
"status": "affected"
},
{
"version": "0.4.8.9",
"status": "affected"
},
{
"version": "0.4.8.10",
"status": "affected"
},
{
"version": "0.4.8.11",
"status": "affected"
},
{
"version": "0.4.8.12",
"status": "affected"
},
{
"version": "0.4.8.13",
"status": "affected"
},
{
"version": "0.4.8.14",
"status": "affected"
},
{
"version": "0.4.8.15",
"status": "affected"
},
{
"version": "0.4.8.16",
"status": "affected"
},
{
"version": "0.4.8.17",
"status": "affected"
},
{
"version": "0.4.8.18",
"status": "unaffected"
},
{
"version": "0.4.9.3-alpha",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
"baseScore": 2.6,
"accessVector": "NETWORK",
"accessComplexity": "HIGH",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "LOW",
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-18T20:41:11.076671Z",
"id": "CVE-2025-4444",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
},
{
"lang": "en",
"value": "CWE-404"
}
]
}
],
"references": [
{
"url": "https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578",
"source": "[email protected]"
},
{
"url": "https://github.com/chunmianwang/Tordos",
"source": "[email protected]"
},
{
"url": "https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?ctiid.324814",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?id.324814",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/?submit.640605",
"source": "[email protected]"
}
]
}