CVE-2015-2688: Torproject Tor

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.

Affected products

• Torproject Tor: before 0.2.4.26 (fixed in 0.2.4.26); from 0.2.5.1, before 0.2.5.11 (fixed in 0.2.5.11)

Published 2020-01-24. Last modified 2026-06-17.