CVE-2007-4098: Tor

Medium severity, CVSS 5.8. EPSS: 1.9% chance of exploitation in the next 30 days.

Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.

Affected products

• Tor Tor: version 0.1.0.10 only; version 0.1.0.11 only; version 0.1.0.12 only; version 0.1.0.13 only; version 0.1.0.14 only; version 0.1.0.18 only; …

Published 2007-07-30. Last modified 2026-06-16.