CVE-2009-0939: Tor

High severity, CVSS 10.0. EPSS: 2.1% chance of exploitation in the next 30 days.

Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.

Affected products

• Tor Tor: up to and including 0.2.0.33; version 0.2.0.1 only; version 0.2.0.2 only; version 0.2.0.3 only; version 0.2.0.4 only; version 0.2.0.5 only; …

Published 2009-03-18. Last modified 2026-06-16.