CVE-2014-5117: Torproject Tor

Medium severity, CVSS 5.8. EPSS: 2.1% chance of exploitation in the next 30 days.

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.

Affected products

• Torproject Tor: up to and including 0.2.4.22; version 0.0.2 only; version 0.0.3 only; version 0.0.4 only; version 0.0.5 only; version 0.0.6 only; …

Published 2014-07-30. Last modified 2026-06-17.